6

Server is actively writing into some file. How to find the file which is receiving heavy i/o ?

2 Answers 2

6

Try iotop. On Debian/Ubuntu:

apt-get install iotop

Then iotop will show you I/O per process. You can then inspect the file descriptors for the process in question if in need of more data - for example with ls -l /proc/<PID>/fd or lsof -p <PID>.

7
  • It needs kernel support though.
    – romaninsh
    May 12, 2011 at 18:43
  • @romaninsh good point, I think it requires kernels >2.6.20 (stock). May 12, 2011 at 18:45
  • Could not run iotop as some of the requirements are not met: - Linux >= 2.6.20 with - I/O accounting support (CONFIG_TASKSTATS,CONFIG_TASK_DELAY_ACCT, CONFIG_TASK_IO_ACCOUNTING)
    – romaninsh
    May 12, 2011 at 18:46
  • Which kernel version/distribution you're running? If you're running something older than 2.6.20 and you're serving something there you should really upgrade if at all possible - kernels older than 2.6.22 if I remember correctly have a blatant security hole (privilege scalation) very easy to exploit. May 12, 2011 at 18:49
  • @Eduardo Ivanec - There are numerous patched kernels older than 2.6.22. RHEL4 for example, is 2.6.9, and RHEL 5 at 2.6.18; both safe and supported.
    – JimB
    May 12, 2011 at 23:47
3

Since I/O accounting isn't available, maybe you could use a solution based on inotify. This is included in the kernel since 2.6.13. Using inotifywatch from inotify-tools you can watch for changes to any file on your system with inotifywatch -r /. It will take a long time to establish all the watches, and you may have to increase /proc/sys/fs/inotify/max_user_watches. Inotifywatch will run until you interrupt it with ctrl-c. After you interrupt, for each file that was accessed it will statistics on the operations that were performed. For example

$ inotifywatch -r ~
Establishing watches...
Finished establishing watches, now collecting statistics.
total  access  modify  close_write  open  moved_from  moved_to  create  filename
6099   0       6092    2            2     1           1         1       /home/example/foo

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .