My system is ubuntu. I want to find out what uses my disk. In fact, I want to see not exactly what uses it, but which parts of it are used. Which files are written and read.

I am building home server, and I don't want disk inside to spin all the time. Unfortunately I don't have "boot from USB" option, so I can't move whole system to USB. So I want to move part of it. Most often used part. For sure /var/log, but what else?

Is there any tool which can tell me what directories/files on my disk were used during let's say last 5 minutes? To know what is using them would be also nice.

5 Answers 5


This command will show you all files that were accessed (read) last 5 minutes:

find / -amin -5

If you want to know which files were modified (write), use -mmin option instead of -amin.

  • Hmm... Why it doesn't work in subdirectories? I tried find /home/<myusername>/<somesubdir> -amin 10000 and it didn't find anything. Looks like it didn't even try, because it finished at once. And I am pretty sure files from this subdir were read during last minutes.
    – amorfis
    Jul 10, 2009 at 10:34
  • Sorry, there was an error. If there will be no - sign before the number, find will search for files, that were modifies exactly 5 minutes ago. '-' stands for 'less then' and '+' for 'greater then'.
    – lexsys
    Jul 10, 2009 at 11:00

iotop can tell you the processes using disk, and lsof can tell you what files those processes have open.

However, that's not what you asked for. To find out what files were accessed specifically, you might try using SystemTap; with the proper configuration this will tell you exactly what you asked for. The iotime.stp example might be a good starting point.


iotop may help it will tell you which applications are causing the disc I/O, I suspect you would then have to use lsof to see which files they where using.



It does the job of telling you what files are open right now, and what has them open. Combine with grep and cron.


I would caution that not all the writes are going to actually be sent down to the disk as often as you think, there are several file system / Kernel buffers that are going to come into play and they all are 'supposed' to help optimize your experience.

The IO activity for a system is going to be very dependent on the applications that are running on it. Can you provide more information on what apps. are going to be running? Any DB's (MySQL, etc.), any server processes that love to generate a lot of log data (Apache/httpd)?

  • The system is not build yet. Apps will be apache, tomcat, maybe glassfish, some DB for sure (most probably PostgreSQL). I assume most often IO will be used for logging.
    – amorfis
    Jul 9, 2009 at 8:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.