Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 5 down vote favorite
1

Server is actively writing into some file. How to find the file which is receiving heavy i/o ?

share|improve this question

2 Answers

up vote 5 down vote accepted

Try iotop. On Debian/Ubuntu:

apt-get install iotop

Then iotop will show you I/O per process. You can then inspect the file descriptors for the process in question if in need of more data - for example with ls -l /proc/<PID>/fd or lsof -p <PID>.

share|improve this answer
It needs kernel support though. – romaninsh May 12 '11 at 18:43
@romaninsh good point, I think it requires kernels >2.6.20 (stock). – Eduardo Ivanec May 12 '11 at 18:45
Could not run iotop as some of the requirements are not met: - Linux >= 2.6.20 with - I/O accounting support (CONFIG_TASKSTATS,CONFIG_TASK_DELAY_ACCT, CONFIG_TASK_IO_ACCOUNTING) – romaninsh May 12 '11 at 18:46
Which kernel version/distribution you're running? If you're running something older than 2.6.20 and you're serving something there you should really upgrade if at all possible - kernels older than 2.6.22 if I remember correctly have a blatant security hole (privilege scalation) very easy to exploit. – Eduardo Ivanec May 12 '11 at 18:49
@Eduardo Ivanec - There are numerous patched kernels older than 2.6.22. RHEL4 for example, is 2.6.9, and RHEL 5 at 2.6.18; both safe and supported. – JimB May 12 '11 at 23:47
show 2 more comments
up vote 2 down vote

Since I/O accounting isn't available, maybe you could use a solution based on inotify. This is included in the kernel since 2.6.13. Using inotifywatch from inotify-tools you can watch for changes to any file on your system with inotifywatch -r /. It will take a long time to establish all the watches, and you may have to increase /proc/sys/fs/inotify/max_user_watches. Inotifywatch will run until you interrupt it with ctrl-c. After you interrupt, for each file that was accessed it will statistics on the operations that were performed. For example

$ inotifywatch -r ~
Establishing watches...
Finished establishing watches, now collecting statistics.
total  access  modify  close_write  open  moved_from  moved_to  create  filename
6099   0       6092    2            2     1           1         1       /home/example/foo
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.