Find out what processes are writing to hard drive
Solution 1
iotop (simple top-like I/O monitor) is a good tool for what you want. It also allows one to display the accumulated amount of I/O on any of the DISK READ, DISK WRITE, SWAPIN, and IO (overall percentage). This is through a nifty interface:
- You just press a on the keyboard, and it will sort the hungriest processes on top.
- Reversing the order, you just press r.
- If you want to sort by other colums, you just press the left/right key.
Like top
, the presentation is rather busy. Another thing is that it doesn't have the myriad options that top
has (e.g. I can't chose to hide any of the columns I'm uninterested in), but the tool is more than good enough for its specific purpose.
Solution 2
You can use lsof
(man lsof). The following will return a list of all files that are open for writing:
lsof | grep -e "[[:digit:]]\+w"
Solution 3
Especially for low disk activity, it is necessary to use iotop in batch mode, to prevent short access lines from disappearing quickly. The answer by How do I log file system read/writes by filename in Linux? shows how to do this.
So far
iotop
is the best overall solution. The following command gives you a real-time output of all the processes using the disk.
iotop -bktoqqq -d .5
where: -b is batch mode
-k is kilobytes/s
-t adds timestamp
-o only show processes or threads actually doing I/O
-qqq removes output headers
-d .5 updates every .5 seconds
Once you have the process id, you can also find the files with
lsof -p $PID
Solution 4
Use strace
.
Related videos on Youtube
Tim
Elitists are oppressive, anti-intellectual, ultra-conservative, and cancerous to the society, environment, and humanity. Please help make Stack Exchange a better place. Expose elite supremacy, elitist brutality, and moderation injustice to https://stackoverflow.com/contact (complicit community managers), in comments, to meta, outside Stack Exchange, and by legal actions. Push back and don't let them normalize their behaviors. Changes always happen from the bottom up. Thank you very much! Just a curious self learner. Almost always upvote replies. Thanks for enlightenment! Meanwhile, Corruption and abuses have been rampantly coming from elitists. Supportive comments have been removed and attacks are kept to control the direction of discourse. Outright vicious comments have been removed only to conceal atrocities. Systematic discrimination has been made into policies. Countless users have been harassed, persecuted, and suffocated. Q&A sites are for everyone to learn and grow, not for elitists to indulge abusive oppression, and cover up for each other. https://softwareengineering.stackexchange.com/posts/419086/revisions https://math.meta.stackexchange.com/q/32539/ (https://i.stack.imgur.com/4knYh.png) and https://math.meta.stackexchange.com/q/32548/ (https://i.stack.imgur.com/9gaZ2.png) https://meta.stackexchange.com/posts/353417/timeline (The moderators defended continuous harassment comments showing no reading and understanding of my post) https://cs.stackexchange.com/posts/125651/timeline (a PLT academic had trouble with the books I am reading and disparaged my self learning posts, and a moderator with long abusive history added more insults.) https://stackoverflow.com/posts/61679659/revisions (homework libels) Much more that have happened.
Updated on September 18, 2022Comments
-
Tim over 1 year
On my Lenovo T400 and Ubuntu, the light for hard drive writing keeps flashing. I was wondering if in Linux it is possible to find out what processes are doing I/O to the hard drive? Just like by
top
, you can find out what processes are using most CPU and memory. -
Gilles 'SO- stop being evil' almost 13 yearsThat's going to tell you what a particular process is doing, it won't help to find which process is doing something.
-
Gilles 'SO- stop being evil' almost 13 yearsPowertop is also useful to find what's using up the battery on a laptop; iotop is still the first place to look for disk accesses.
-
psusi almost 13 yearsWhat files are open, and what files are actually being accessed are two different things.
-
James Sumners almost 13 years@psusi An open file for writing is very likely being "accessed." Also, more information can be retrieved by learning lsof via its manpage.
-
psusi almost 13 yearsFiles open for writing may be written to at some point, but not necessarily right now. Many files are kept open but are rarely written to. On the other hand, the files being written to may be opened and closed quickly and so won't show up in lsof. Either way, it is of little help figuring out what process is actually writing to the disk at the moment.
-
Martijn over 9 yearsThe
w
from the command above make you grep for files that are open for writing only. Files open for writing and reading (u
) will not be displayed, but they can also be written to. If you'd like to see files open for write and for read+write, I believe this is what you're looking for:lsof | grep -e "[[:digit:]]\+[wu]\{1\}"
-
Admin over 9 years@Martijn You'll want to use
grep -e**w**
to avoid matching[0-9]\+[wu]
inside another columns -
voices about 8 years@user84010 What's the whole command that you're suggesting?
-
Stephen Rauch about 7 yearsHow does this answer differ from the above (very old) answers? It is good when answering an old question to explain how your answer differs from previous answers. This helps reader sort among the answers.
-
Frank Breitling about 7 yearsThanks for pointing this out. I have edited this answer taking your comment into account.
-
Marcin Orlowski almost 5 yearsone can pass
-o
(--only
) to actually filter out all the tasks not doing any I/O. This makes the list less crowded -
codenoob almost 3 yearsIs there a way to show activity only on a particular mount/disk? I can't find such.