This is probably unanswerable. But maybe someone else will have this problem and find this question, append to it, or proffer an answer.
I discovered the
pidstat command with its
-d option, today. Apparently, on my RHEL6 systems,
init (upstart) is a heavy I/O user; and on RHEL7 systems,
systemd is an I/O abuser. Why? What are either of these processes doing once the system has started? I checked syslog and see no indication of a process that is being respawned.
# pidstat -d -p 1 Linux 2.6.32-358.el6.x86_64 (db05-a.intra.uibk.ac.at) 01/27/2016 _x86_64_ (8 CPU) 12:50:18 PM PID kB_rd/s kB_wr/s kB_ccwr/s Command 12:50:18 PM 1 23.76 66.67 0.77 init # pidstat -d -C systemd Linux 3.10.0-229.1.2.el7.x86_64 (dbmon01.uibk.ac.at) 01/27/2016 _x86_64_ (4 CPU) 12:50:59 PM UID PID kB_rd/s kB_wr/s kB_ccwr/s Command 12:50:59 PM 0 1 10.82 220.18 3.01 systemd 12:50:59 PM 0 503 0.00 0.00 0.00 systemd-journal 12:50:59 PM 0 527 0.00 0.00 0.00 systemd-udevd 12:50:59 PM 0 730 0.00 0.00 0.00 systemd-logind
As @sourcejedi and a colleague suggested: attach to the process with strace. They were just listening on a socket.
systemd was doing a little more than that, but only very low levels of reading. Possibly some days before on each system, something "happened", but only these traces remain.