I just installed atop, waited half an hour, and looked at the logs with atop -r /var/log/atop/atop_20180216.
Why does my systemd --user instance show hundreds of megs of disk usage, including tens of megs of writes, during one ten minute interval? What can systemd possibly be doing?
PID TID RDDSK WRDSK WCANCL DSK CMD 1/285
2831 - 333.8M 25556K 1196K 87% systemd
[RDDSK / WRDSK]
When the kernel maintains standard io statistics (>= 2.6.20): The [read / write] data transfer issued physically on disk (so writing to the disk cache is not accounted for). This counter is maintained for the application process that writes its data to the cache (assuming that this data is physically transferred to disk later on). Notice that disk I/O needed for swapping is not taken into account. Unfortunately, the kernel aggregates the data tranfer of a process to the data transfer of its parent process when terminating, so you might see transfers for (parent) processes like cron, bash or init, that are not really issued by them.
https://www.systutorials.com/docs/linux/man/1-atop/
(I agree this is unfortunate. Especially given atop's advertised feature of showing resources used even by processes which exited at some point during the monitoring interval, implemented using process accounting aka psacct).
