I am trying to track where excessive disk writes are coming from whether by mail coming in, db writes, logs or another source. There are about 75 accounts on the server, some active and some not.

Is there any type of disk I/O command I can execute which will specify the DIRECTORY(ies) to which disk writes are happening? If it's a db write, I would expect I'd see it come through on /var/lib/mysql/that_database_name


I vaguely recall about 2 years ago I executed some command that was similar to a tail -f where I was watching the writes come through, and I think that specified the folder. If I was tailing a disk write log (if such a thing exists), then it's location or its access in this format would accomplish what I am wanting to.

  • Disk writes are done by inode, not by directory. Reversing indodes to filenames is hard, certainly not something you can do in real time. It's probably more feasible to monitor what processes do the writes. – Satō Katsura Apr 6 '17 at 8:21
  • I don't need to know the file names, just the inode to which a write has taken place. That can give me everything I need. – Oliver Williams Apr 6 '17 at 8:23
  • I recall there was a command that had an output real-time similar to tail -f which listed the write event and IIRC the directory/inode – Oliver Williams Apr 6 '17 at 8:26
  • 2
    Since you're using Linux, try iotop. – Satō Katsura Apr 6 '17 at 8:33
  • This is not exactly like the command that I remember, or the output (though it is giving useful information). In fact maybe I was doing a tail of a write log previously! Any idea, if that was true, if in fact there is a write log to tail? – Oliver Williams Apr 6 '17 at 8:38

You might be thinking of fatrace, which can monitor all writes to a filesystem, eg:

$ sudo fatrace -f W 
chrome(19909): W /home/meuh/.config/google-chrome/Default/Current Session
bash(2777): CW /home/meuh/.bashhistory
emacs(2100): CW /home/meuh/bin/emacs/.emacs.desktop
auditd(711): W /var/log/audit/audit.log
rsyslogd(762): W /var/log/secure

The -f W restricts output to any write operations, listing executable, pid, and file written.

Another possibility is iosnoop from Brendan D. Gregg's perf-tools which gives low-level info on blocks written to a disk:

$ sudo perf-tools-master/bin/iosnoop
Tracing block I/O. Ctrl-C to end.
COMM         PID    TYPE DEV      BLOCK        BYTES     LATms
/usr/bin/mon 31456  R    8,0      9741888      4096       2.14
/usr/bin/mon 31456  R    8,0      12904784     4096       1.43
jbd2/sda3-41 416    WS   8,0      130618232    65536      1.89
jbd2/sda3-41 416    WS   8,0      210006528    8192       1.94
<...>        288    WS   8,0      129710104    61440      1.85
<idle>       0      WS   8,0      129710224    4096       0.36
cat          32111  WS   8,0      10443000     4096       0.35

Another possibility, if you only want to watch a few sets of files is inotifywait, eg:

$ inotifywait -m -e modify -r /tmp
Setting up watches.  Beware: since -r was given, this may take a while!
Watches established.
/tmp/ MODIFY myfile

The -r is recursive down the given directories. This is costly to setup, and users are limited by default to 8192 watches, but you can change this in /proc/sys/fs/inotify/max_user_watches.

| improve this answer | |
  • fatrace sounds what I used. yum update && yum install fatrace don't recognize the package; how do I get yum to recognize the correct repo here? rpms.remirepo.net/rpmphp/zoom.php?rpm=fatrace – Oliver Williams Apr 6 '17 at 17:31
  • 1
    I'm using fedora 23 where dnf (which replaces yum) found it ok. What version do you have? You might also search here, rpmfind. – meuh Apr 6 '17 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.