50

On my Lenovo T400 and Ubuntu, the light for hard drive writing keeps flashing. I was wondering if in Linux it is possible to find out what processes are doing I/O to the hard drive? Just like by top, you can find out what processes are using most CPU and memory.

Anthon
  • 78,313
  • 42
  • 165
  • 222
Tim
  • 98,580
  • 191
  • 570
  • 977

5 Answers5

65

iotop (simple top-like I/O monitor) is a good tool for what you want. It also allows one to display the accumulated amount of I/O on any of the DISK READ, DISK WRITE, SWAPIN, and IO (overall percentage). This is through a nifty interface:

  • You just press a on the keyboard, and it will sort the hungriest processes on top.
  • Reversing the order, you just press r.
  • If you want to sort by other colums, you just press the left/right key.

Like top, the presentation is rather busy. Another thing is that it doesn't have the myriad options that top has (e.g. I can't chose to hide any of the columns I'm uninterested in), but the tool is more than good enough for its specific purpose.

Rodrigo
  • 1,732
  • 2
  • 16
  • 29
tshepang
  • 64,472
  • 86
  • 223
  • 290
21

You can use lsof (man lsof). The following will return a list of all files that are open for writing:

lsof | grep -e "[[:digit:]]\+w"
James Sumners
  • 321
  • 1
  • 6
  • 5
    What files are open, and what files are actually being accessed are two different things. – psusi Jul 15 '11 at 17:27
  • @psusi An open file for writing is very likely being "accessed." Also, more information can be retrieved by learning lsof via its manpage. – James Sumners Jul 15 '11 at 17:41
  • 8
    Files open for writing may be written to at some point, but not necessarily right now. Many files are kept open but are rarely written to. On the other hand, the files being written to may be opened and closed quickly and so won't show up in lsof. Either way, it is of little help figuring out what process is actually writing to the disk at the moment. – psusi Jul 15 '11 at 18:57
  • The `w` from the command above make you grep for files that are open for writing _only_. Files open for writing _and_ reading (`u`) will not be displayed, but they can also be written to. If you'd like to see files open for write and for read+write, I believe this is what you're looking for: `lsof | grep -e "[[:digit:]]\+[wu]\{1\}"` – Martijn Sep 01 '14 at 22:23
  • 1
    @Martijn You'll want to use `grep -e**w**` to avoid matching `[0-9]\+[wu]` inside another columns –  Sep 12 '14 at 21:03
  • @user84010 What's the whole command that you're suggesting? – voices Mar 11 '16 at 11:02
9

Especially for low disk activity, it is necessary to use iotop in batch mode, to prevent short access lines from disappearing quickly. The answer by How do I log file system read/writes by filename in Linux? shows how to do this.

So far iotop is the best overall solution. The following command gives you a real-time output of all the processes using the disk.

iotop -bktoqqq -d .5

where: -b     is batch mode
       -k     is kilobytes/s
       -t     adds timestamp
       -o     only show processes or threads actually doing I/O
       -qqq   removes output headers
       -d .5  updates every .5 seconds

Once you have the process id, you can also find the files with

 lsof -p $PID
Community
  • 1
Frank Breitling
  • 959
  • 3
  • 12
  • 25
  • 1
    How does this answer differ from the above (very old) answers? It is good when answering an old question to explain how your answer differs from previous answers. This helps reader sort among the answers. – Stephen Rauch Feb 12 '17 at 17:06
  • Thanks for pointing this out. I have edited this answer taking your comment into account. – Frank Breitling Feb 12 '17 at 21:30
1

Use strace.

user541686
  • 3,033
  • 5
  • 28
  • 43
1

fatrace can help you with that. Shameless link to my own answer on another question about this:

iotop but for particular disk?

phil294
  • 875
  • 12
  • 15