Server is actively writing into some file. How to find the file which is receiving heavy i/o ?
2 Answers
Try iotop. On Debian/Ubuntu:
apt-get install iotop
Then iotop
will show you I/O per process. You can then inspect the file descriptors for the process in question if in need of more data - for example with ls -l /proc/<PID>/fd
or lsof -p <PID>
.
-
-
@romaninsh good point, I think it requires kernels >2.6.20 (stock). May 12, 2011 at 18:45
-
Could not run iotop as some of the requirements are not met: - Linux >= 2.6.20 with - I/O accounting support (CONFIG_TASKSTATS,CONFIG_TASK_DELAY_ACCT, CONFIG_TASK_IO_ACCOUNTING) May 12, 2011 at 18:46
-
Which kernel version/distribution you're running? If you're running something older than 2.6.20 and you're serving something there you should really upgrade if at all possible - kernels older than 2.6.22 if I remember correctly have a blatant security hole (privilege scalation) very easy to exploit. May 12, 2011 at 18:49
-
@Eduardo Ivanec - There are numerous patched kernels older than 2.6.22. RHEL4 for example, is 2.6.9, and RHEL 5 at 2.6.18; both safe and supported.– JimBMay 12, 2011 at 23:47
Since I/O accounting isn't available, maybe you could use a solution based on inotify. This is included in the kernel since 2.6.13. Using inotifywatch from inotify-tools you can watch for changes to any file on your system with inotifywatch -r /
. It will take a long time to
establish all the watches, and you may have to increase /proc/sys/fs/inotify/max_user_watches. Inotifywatch will run until you interrupt it with ctrl-c. After you interrupt, for each file that was accessed it will statistics on the operations that were performed. For example
$ inotifywatch -r ~
Establishing watches...
Finished establishing watches, now collecting statistics.
total access modify close_write open moved_from moved_to create filename
6099 0 6092 2 2 1 1 1 /home/example/foo