Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my Lenovo T400 and Ubuntu, the light for hard drive writing keeps flashing. I was wondering if in Linux it is possible to find out what processes are doing I/O to the hard drive? Just like by top, you can find out what processes are using most CPU and memory.

share|improve this question
up vote 25 down vote accepted

Iotop is a good tool for what you want. It also allows one to display the accumulated amount of I/O on any of the DISK READ, DISK WRITE, SWAPIN, and IO (overall). This is through a nifty interface:

  • You just press a on the keyboard, and it will sort the hungriest processes on top.
  • Reversing the order, you just press r.
  • If you want to sort by other colums, you just press the left/right key.

Like top, the presentation is rather busy. Another thing is that it doesn't have the myriad options that top has (e.g. I can't chose to hide any of the columns I'm uninterested in), but the tool is more than good enough for its specific purpose.

share|improve this answer
Powertop is also useful to find what's using up the battery on a laptop; iotop is still the first place to look for disk accesses. – Gilles Jul 15 '11 at 10:48

You can use lsof (man lsof). The following will return a list of all files that are open for writing:

lsof | grep -e "[[:digit:]]\+w"
share|improve this answer
What files are open, and what files are actually being accessed are two different things. – psusi Jul 15 '11 at 17:27
@psusi An open file for writing is very likely being "accessed." Also, more information can be retrieved by learning lsof via its manpage. – James Sumners Jul 15 '11 at 17:41
Files open for writing may be written to at some point, but not necessarily right now. Many files are kept open but are rarely written to. On the other hand, the files being written to may be opened and closed quickly and so won't show up in lsof. Either way, it is of little help figuring out what process is actually writing to the disk at the moment. – psusi Jul 15 '11 at 18:57
The w from the command above make you grep for files that are open for writing only. Files open for writing and reading (u) will not be displayed, but they can also be written to. If you'd like to see files open for write and for read+write, I believe this is what you're looking for: lsof | grep -e "[[:digit:]]\+[wu]\{1\}" – Martijn Sep 1 '14 at 22:23
@Martijn You'll want to use grep -e**w** to avoid matching [0-9]\+[wu] inside another columns – user84010 Sep 12 '14 at 21:03

Use strace.

share|improve this answer
That's going to tell you what a particular process is doing, it won't help to find which process is doing something. – Gilles Jul 15 '11 at 10:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.