I am running a corporate-issued remix of Red Hat Enterprise Linux 6.7. Every now and then, my hard drive will slow down to a crawl due to non-sequential file reading activity, and I believe it might be due to a company-issued workstation security enforcement app which I am not allowed to shut down. My plan is to determine if one particular file is being read, and if this is the case, move these files to an USB 3.0 stick so they can be read faster than on a mechanical hard drive.

I searched for an answer on this, but the only alternative seems to be using the Linux audit subsystem (auditd), which I'm not sure if it's going to be feasible using on my entire root filesystem.

  • Can you install sysdig ? – thrig Mar 27 '17 at 15:21
  • askubuntu.com/questions/105189/… – basin Mar 27 '17 at 17:13
  • I tried sysdig, but it doesn't seem to be accurate. It failed to show that IBM Lotus Notes was slowing down my workstation today. – RAKK Mar 28 '17 at 22:23

You can use inotifywait to keep an eye on file reads. Unfortunately the obvious invocation crashes out on my little VM after a couple of minutes with the error, Couldn't watch /: Operation not permitted:

inotifywait --monitor --recursive --event access /

This works, though:

find / -mount -type f |
    sort |
    inotifywait --fromfile - --monitor --recursive --event access

Please be aware that you may need to increase the default number of directory watches. This little snippet of code will show you what you have configured and what you need, and will increase it if necessary:

need=$(find / -mount -type d | wc -l)
got=$(cat /proc/sys/fs/inotify/max_user_watches)
echo "Got $got and need $need watches"

[[ $need -gt $got ]] && echo $((need + 100)) >/proc/sys/fs/inotify/max_user_watches

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.