I want to connect another hard disk to my computer, which I want to sleep 99% of the time. I will only use it for a few things, but I need it to be mounted at all times.

To achieve this I would like to know:

  1. How do I log which processes accesses a device? I need the logging to be able to tell what is causing the hard disk to wake up if it does, so I may act on it.
  2. Are there any special kernel settings I need to make so that the device may sleep longer?
  3. How do I set the sleep intervals of the hard disk?

Sleep interval is called "APM" (Automatic Power Management) and spindown_time. This is controlled with hdparm like this:

hdparm -B 50 -S 36 /dev/disk/by-label/BACKUP-HDD

It will make your HDD to spindown on ~3min inactivity.


As you are on linux, you can use the new fatrace utility, which logs every file access and tells you which process is responsible:


More information here:


It makes use of the linux fanotify API (more details) available since linux kernel 2.6.37.

fatrace isn't packaged by all distributions as of July 2014 (it entered debian testing recently, so should ship in 'jessie'), but is easy to install from source.

  • 1
    I don't know what you mean by "most" distributions. As usual Debian is the last distro to get something. I have had it available on Fedora for quite some time... – Michael Hampton Jul 28 '14 at 11:19

http://en.wikipedia.org/wiki/Fuser_%28Unix%29 - fuser is a UNIX command used to show which processes are using a specified file, file system, or socket.

http://sourceforge.net/projects/hdparm/ - get/set ATA/SATA drive parameters under Linux (look for -S option)

http://sg.danny.cz/sg/sg3_utils.html - The sg3_utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI (look for sg_start)

  • Thanks for your informative answer! It looks like fuser only tells me which processes are using a file, filesystem och socket at the instance of issuing the command. While this is very useful if a process does something quick, like list the contents of the device root directory, I might miss it even if I have fuser running in a loop. If there were something which would wait and log all activity until I tell it to stop, it would be even more helpful in this situation. Do you know of any? – Deleted Dec 13 '09 at 11:12
  • I guess hdparam is what i'll use to setup wait time before sleeping? And the sg3_utils is just a powerful tool but I won't use it in this case? (As I guess I won't have to specifying manually when the HDD should sleep after setting it up using hdparam?) – Deleted Dec 13 '09 at 11:13

btrace or blktrace (a wrapper of btrace) track kernel block I/O and can help you there.


I have similar issue. I have SSD, /dev/sdb, with OS (Linux Mint 18.1 based on Ubuntu Xenial) and HDD, /dev/sda, with data, which I use time to time. Both disks are encrypted. HDD's partitions are not mounted. And anyway in periods of several minutes HDD wakes up, then sleeps, then wakes up again. Mess.

Here is a duplicate question with helpful answer, which suggests auditd to find the bad-behaving process.

apt-get install auditd
auditctl -w /dev/sda -p rwa

Then I force HDD to sleep with hdparm -Y /dev/sda. Then wait until I hear HDD spinning up again. Then run ausearch -f /dev/sda. In my case it shows entries like the following.

time->Sat Feb 25 12:38:17 2017
type=PROCTITLE msg=audit(1488022697.651:1744): proctitle=2F7573722F6C69622F756469736B73322F756469736B7364002D2D6E6F2D6465627567
type=PATH msg=audit(1488022697.651:1744): item=0 name="/dev/sda" inode=376 dev=00:06 mode=060660 ouid=0 ogid=6 rdev=08:00 nametype=NORMAL
type=CWD msg=audit(1488022697.651:1744):  cwd="/"
type=SYSCALL msg=audit(1488022697.651:1744): arch=c000003e syscall=2 success=yes exit=12 a0=f3fb90 a1=800 a2=7f4745221f64 a3=30 items=1 ppid=1 pid=18520 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="pool" exe="/usr/lib/udisks2/udisksd" key=(null)

Relevant part is exe="/usr/lib/udisks2/udisksd". Though I also had smartmontools whose smartd was also the culprit. I uninstalled smartmontools and stopped udisk2 service with service udisks2 stop. After that HDD sleeps as expected.

Note that udisks2 will automatically start when I, for instance, open Disks application, so I have to stop it again. Another downside is that SMART parameters are not monitored for both disk, which is not good but as a workaround it fits.

Also one thing that is not clear, is that this bug report says udisks2 doesn't do polling disks which is now done by kernel. But the evidence seems to indicate the contrary.

  • Interesting analysis! Also thanks for providing the details how you debugged this via auditd. I wonder, your report is now 3 years old, and the bug report you linked is marked as fixed. Maybe your workaround is not needed anymore? – Albert May 2 '20 at 12:05

lsof +D /path/to/mount should show you every process which has any opened file in the path indicated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.