Find what program/process is writing to disk and what file it is writing to

Question

Possible Duplicate:
How to tell what applications are accessing the hard drive and how frequently?

I left my desktop untouched for period of time. The HDD led still flashes every second and makes a tick sound. Is there any way to find out which process is doing it and which file it writes to?

Solution

Update from a reader's comment

You can install and use fatrace. It is a small command line utility that enables you to view the process that is reading/writing to a file. Install it with

sudo apt-get install fatrace

Run it in a terminal with sudo fatrace. It will show you information in auto-scrolling fashion like this

rsyslogd(971): W /var/log/syslog
rsyslogd(971): W /var/log/mail.log
rsyslogd(971): W /var/log/mail.log
rsyslogd(971): W /var/log/mail.err
rsyslogd(971): W /var/log/mail.err
ruby(5094): R /home/anwar/..../config/initializers
ruby(5094): RC /home/anwar/..../config/initializers
ruby(5094): O /home/anwar/..../config/initializers
ruby(5094): R /home/anwar/..../config/initializers
ruby(5094): RC /home/anwar/..../config/initializers

[.... are input by me.]

• The first column include the name of the process and it's process id in brackets like ruby(5094) followed by a :.

• The second column is the event type indicator. The event types are there - (from man page)

  Open, Read, Write, or Close. Combinations are possible, such as CW for closing a written file.

• The last column is the file involved in the operation with full path name.

---

Use iotop program. To install it, use terminal with the command

sudo apt-get install iotop

or using this link iotop

and then use sudo iotop in a terminal to see the programs using your disk.

To open a terminal, use Ctrl + Alt + T keyboard shortcut

Comments

[Sanam Patel]

Possible duplicate?

[underscore_d]

This is remarkably high up Google for something that only answered half of the asked question. Which, to be fair, makes me wonder why it was accepted. Well, at least in the duplicate, which didn't explicitly specify a need to see which files - the one thing that would show that info can be found at the bottom of the page: fatrace. And handily for me, it's already in the Debian repos.

[Anwar]

@underscore_d Thank you for your comment. I'm putting that information in the answer

[underscore_d]

That's now way better than the other thread :) fwiw, I found Konsole was reading /etc/passwd a lot - perhaps as part of fatraceing - so I wanted to exclude it from results. Luckily, the man shows this is easy: pass the PID of any process to exclude as an arg: -p1234. We can add multiple args like this to exclude more than one process. I settled on fatrace -tp1234, where -t prepends human-readable timestamps to each row.

[Programmer]

@underscore_d you could also use grep to filter out certain files: fatrace | grep -v /etc/passwd