Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a machine that runs few services, but I don't believe they are responsible for sometimes heavy disk access on this server (massive head moving which I can hear, after long periods of almost no movement)

How can I find out which process is doing something on the hard disk when there is such a period again?

I was thinking to use the linux command "lsof", but it has overwhealming output and options, so I can't see anything.

Can you guide me how would I

  • show only hard disk access
  • that is really physicaly currently happing (not buffered or only opened files, actually physical reading or writing)
  • maybe sort or filter by user or process

Would be great if you could demonstrate some useful options of lsof for such a case. Thank you.

Edit Thank you for all answers. This is much more than I expected and I upvoted all answers (until today)

share|improve this question
up vote 7 down vote accepted

Try looking at "iotop". It will give you just what you need, a per process IO usage, top like, display. Comes with most modern linux distributions

share|improve this answer

Often when you have a system where the services / applications aren't performing a lot of disk I/O but you notice a lot of hard drive activity you'll find the system swapping a lot.

This article has a good explanation of how this works:

Monitoring Virtual Memory with vmstat

share|improve this answer

I also agree with the suggestions of the top type utilities. However, you might be able to find the source of the problem quicker if you look at your cron jobs. Check the contents of /etc/cron.* and see if there are any cron jobs that run processes which would cause a lot of disk I/O. It may be something as simple as updatedb updating the locate database.

If the servers allow user login, you should also check the user crontabs. They're typically found in /var/spool/cron/tabs.

share|improve this answer

I have a machine that runs few services, but I don't believe they are responsible for sometimes heavy disk access on this server

Does this happen once per day? If yes, probably this is the system that checks repositories for updates, or automatically installs security patches if it is configured this way.

You can change the interval between checks and configure automatic updates in Synaptic

share|improve this answer

Unless you want details on which files are being accessed, I believe you can also get this information using top. I use the htop ( top wrapper ) to monitor I/O usage, having the output sorted by different I/O fields. It gives the following columns to look at: RCHAR, WCHAR, SYSCR, SYSCW, IO_READ_RATE, IO_WRITE_RATE, IO_RATE. Have a look at man top if this if what you require.

share|improve this answer

Watch top for a while. IO bound programs usually are stuck in D-state. So sort your top output by cpu, and just watch which process is gonna be toward the top with extensive periods in D-state.

share|improve this answer

tools mentiond thus are great for realtime monitoring-- a good question possibly for a new post: what is somethng that can be used historically- use case:

my box showed IO spike at 1AM

how do you know where it came from? : )

share|improve this answer
-1 please don't post new questions as answers. – sleske Dec 29 '11 at 16:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.