0

I need to identify what process is writing non-stop on the Disk.

I tried to run prstat -t to get the list of the processes running, but I can't identify/find which process it is.

running df -k , I can see that the space on a given path of the Disk is continuously decreasing.

after killing all the processes (and closing all the external connections) that could ever write on the disk , still there is something that writes on it.

OS Solaris 10

  • 2
    iosnoop – Mark Plotnick Jan 17 at 2:08
  • @MarkPlotnick Note that iosnoop won't be able to completely identify processes using the filesystem in all possible ways. It will not show processes that merely have a current working directory in the file system, and it may not be able to track IO from mmap()'d files back to the actual process, as that data could potentially be from multiple processes, and the process id might get "lost" as the data passes through any cache. – Andrew Henle Jan 17 at 4:35
1

It won't show the actual IO operations, but you can also use the fuser utility to identify process(es) using the filesystem in any way, even those that don't cause actual IO, or do IO in ways that can't be traced back to a particular process (mmap() of files is one, where a file can be mmap()'d by multiple processes):

Synopsis

/usr/sbin/fuser [-c | -d | -f] [-nu] [-k | -s sig] files 
     [ [- ] [-c | -d | -f] [-nu] [-k | -s sig] files] ...

Description

The fuser utility displays the process IDs of the processes that are using the files specified as arguments.

Each process ID is followed by a letter code. These letter codes are interpreted as follows. If the process is using the file as

c Indicates that the process is using the file as its current directory.

m Indicates that the process is using a file mapped with mmap(2). See mmap(2) for details.

n Indicates that the process is holding a non-blocking mandatory lock on the file.

o Indicates that the process is using the file as an open file.

r Indicates that the process is using the file as its root directory.

t Indicates that the process is using the file as its text file.

y Indicates that the process is using the file as its controlling terminal.

Example:

Assuming your home directory is on a separate filesystem mounted at /export/home, this will show all processes using files in any manner on that file system, including those processes that aren't doing any IO but have a current working directory in that filesystem along with processes that have files memory mapped from that file system:

fuser -c /export/home

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.