2

I have a machine that runs few services, but I don't believe they are responsible for sometimes heavy disk access on this server (massive head moving which I can hear, after long periods of almost no movement)

How can I find out which process is doing something on the hard disk when there is such a period again?

I was thinking to use the linux command "lsof", but it has overwhealming output and options, so I can't see anything.

Can you guide me how would I

  • show only hard disk access
  • that is really physicaly currently happing (not buffered or only opened files, actually physical reading or writing)
  • maybe sort or filter by user or process

Would be great if you could demonstrate some useful options of lsof for such a case. Thank you.

Edit Thank you for all answers. This is much more than I expected and I upvoted all answers (until today)

7 Answers 7

7

Try looking at "iotop". It will give you just what you need, a per process IO usage, top like, display. Comes with most modern linux distributions

2

Often when you have a system where the services / applications aren't performing a lot of disk I/O but you notice a lot of hard drive activity you'll find the system swapping a lot.

This article has a good explanation of how this works:

Monitoring Virtual Memory with vmstat

2

I also agree with the suggestions of the top type utilities. However, you might be able to find the source of the problem quicker if you look at your cron jobs. Check the contents of /etc/cron.* and see if there are any cron jobs that run processes which would cause a lot of disk I/O. It may be something as simple as updatedb updating the locate database.

If the servers allow user login, you should also check the user crontabs. They're typically found in /var/spool/cron/tabs.

2

I have a machine that runs few services, but I don't believe they are responsible for sometimes heavy disk access on this server

Does this happen once per day? If yes, probably this is the system that checks repositories for updates, or automatically installs security patches if it is configured this way.

You can change the interval between checks and configure automatic updates in Synaptic

1

Unless you want details on which files are being accessed, I believe you can also get this information using top. I use the htop ( top wrapper ) to monitor I/O usage, having the output sorted by different I/O fields. It gives the following columns to look at: RCHAR, WCHAR, SYSCR, SYSCW, IO_READ_RATE, IO_WRITE_RATE, IO_RATE. Have a look at man top if this if what you require.

1

Watch top for a while. IO bound programs usually are stuck in D-state. So sort your top output by cpu, and just watch which process is gonna be toward the top with extensive periods in D-state.

-1

tools mentiond thus are great for realtime monitoring-- a good question possibly for a new post: what is somethng that can be used historically- use case:

my box showed IO spike at 1AM

how do you know where it came from? : )

1
  • -1 please don't post new questions as answers.
    – sleske
    Dec 29, 2011 at 16:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .