Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just trying to get to the bottom of this. I run a Web app on a LAMP stack on Amazon EC2.

Typically the server is writing about 2.5MB/min to the hard drives. It looks like the apache log file and the amount actually written rises and falls precisely in the same shape as my network in/out graphs. The database is read only and the only writes to hard drive should be logs.

But precisely every 15 minutes the server also does a 12-15MB write to the hard drive - I do not know what this could be. The only clue is that it too follows the shape of my network in/out graph, only more exaggerated. There is no cronjob that runs on that frequency.

How do I go about figuring out what this 12-15MB write is ?

share|improve this question
I had a similar problem (perhaps unrelated) where APC was set to use a file backed cache instead of a memory backed cache. You may also want to look into disk caching as a possible cause. Some helpful tools for tracking down the process responsible for the writes include iotop and ftop. – cyberx86 Jan 19 '12 at 21:45
up vote 2 down vote accepted

You could use inotify (, the distribution you're using has most likely a package for this) to watch the log directory and see if there is increased activity there. Similarly, you can watch the rest of the file system to see where the writes go. Use something like

inotifywatch -r /var/log -e modify -t <timeout>

Once you have identified the file that is written to, you can use something like lsof (again, most likely available as a package in your distribution) to see which programs access that file, like

lsof /var/log/<file>

If new files are being written or the file descriptor isn't kept open, you can combine inotify and lsof like

inotifywait -e modify /var/log/<file>; lsof -p /var/log/<file>

If none of that helps, have a look at something like SystemTap (, although that might require you to compile/install a special kernel.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.