Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a Ubuntu system which is writing a block to disk every 1-2 seconds. Some kind of log accruing an error. How do I find which file it is?

I've been poring over lsof output and tailing suspects with no luck. Is there a way to find it, really find it?

share|improve this question

migrated from May 15 '11 at 7:15

This question came from our site for professional and enthusiast programmers.

What makes you think something is writing to the disk every 1 -2 seconds? Are you basing this off the drive LEDs? It can be very tricky to get Linux to minimize writes to the disk. Some disk flushes happen automatically every few seconds. – mfarver May 15 '11 at 20:00

Maybe you can check which process is writing frequently to disk with iotop, then spy this process with strace.

share|improve this answer
yea, iotop, that's the ticket, looks like it's just jbd2 .... – qbxk May 14 '11 at 21:52

You could use inotifywatch(1). Something like this should get you closer

inotifywatch -v -e modify  -r /root
share|improve this answer
Interesting. I was not familiar with that command. – ewwhite May 15 '11 at 22:42

Besides the other answers, you could also try just using find / -mtime -1 to list files recently modified.

share|improve this answer

I've done iostat to find what disk was getting the access, then lsof|grep to find files, perhaps look at what looks like log files, filter out tcp or something.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.