Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My system is ubuntu. I want to find out what uses my disk. In fact, I want to see not exactly what uses it, but which parts of it are used. Which files are written and read.

I am building home server, and I don't want disk inside to spin all the time. Unfortunately I don't have "boot from USB" option, so I can't move whole system to USB. So I want to move part of it. Most often used part. For sure /var/log, but what else?

Is there any tool which can tell me what directories/files on my disk were used during let's say last 5 minutes? To know what is using them would be also nice.

share|improve this question

closed as off topic by Bryan, Wesley, Magellan, MDMarra, John Gardeniers Nov 25 '12 at 2:40

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

This command will show you all files that were accessed (read) last 5 minutes:

find / -amin -5

If you want to know which files were modified (write), use -mmin option instead of -amin.

share|improve this answer
Hmm... Why it doesn't work in subdirectories? I tried find /home/<myusername>/<somesubdir> -amin 10000 and it didn't find anything. Looks like it didn't even try, because it finished at once. And I am pretty sure files from this subdir were read during last minutes. – amorfis Jul 10 '09 at 10:34
Sorry, there was an error. If there will be no - sign before the number, find will search for files, that were modifies exactly 5 minutes ago. '-' stands for 'less then' and '+' for 'greater then'. – lexsys Jul 10 '09 at 11:00

iotop can tell you the processes using disk, and lsof can tell you what files those processes have open.

However, that's not what you asked for. To find out what files were accessed specifically, you might try using SystemTap; with the proper configuration this will tell you exactly what you asked for. The iotime.stp example might be a good starting point.

share|improve this answer

iotop may help it will tell you which applications are causing the disc I/O, I suspect you would then have to use lsof to see which files they where using.

share|improve this answer


It does the job of telling you what files are open right now, and what has them open. Combine with grep and cron.

share|improve this answer

I would caution that not all the writes are going to actually be sent down to the disk as often as you think, there are several file system / Kernel buffers that are going to come into play and they all are 'supposed' to help optimize your experience.

The IO activity for a system is going to be very dependent on the applications that are running on it. Can you provide more information on what apps. are going to be running? Any DB's (MySQL, etc.), any server processes that love to generate a lot of log data (Apache/httpd)?

share|improve this answer
The system is not build yet. Apps will be apache, tomcat, maybe glassfish, some DB for sure (most probably PostgreSQL). I assume most often IO will be used for logging. – amorfis Jul 9 '09 at 8:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.