See what files are being written to (like iotop but for files, not processes)

Question

I have a Linux server, and it's doing a lot of disk io. There is one process that is doing most of the disk writes. I found this out with iotop, which shows the processes that are doing disk I/O. Is there an equivant programme (in the debian lenny apt repositories) that will show me what files are being written to? a 'top' like interface would be great? Is this even possible?

Solution 1

lsof may help if you know the process you want to watch:

lsof -p <pid> -r 5

-r is the number of seconds between checks.

Solution 2

You can use sysdig:

sudo apt-get install sysdig;
sysdig -c topfiles_bytes;

There's also an interactive (top-like) terminal program that might be useful in your case.

csysdig;

Comments

[Araejay]

that'll show me what files are being written, is there any way to see how much data is being written?

[Cakemox]

I am not aware of a tool which does both, so in the meantime you may just want to watch the files (once identified with lsof) with du over some period of time to see the changes.

[Valerio Bozzolan]

This is not available anymore in Debian buster.

[alchemy]

This is awesome! apt install sysdig works 2021-11.. command: csysdig

[Admin]

I was able to use on buster by downloading package from github.com/draios/sysdig/releases/tag/0.29.3