How to use lsof to find high activity file writing?

Question

I recently discovered that a buggy program called pcmanfm was writing 200 MB per second to its run.log file, so I had to find ways to combat that. I discovered what file it was that it was writing to in a laborious manner: du -h for various directories trying to find the offending file.

I'm now faced with another similar situation. Something is filling up my hard drive and I have no idea what it is, although I can guess.

Is there a way to use lsof to find out what 1 or 2 files are being written to at a high rate?

• Can I sort the file list by file size?
• Can I sort the file list by writing rate i.e. bytes/second?

Answer 1

I am finding that iotop is quite effective, however it updates its display too rapidly to allow for cut-and-paste of anything like PIDs and program paths.

UPDATE: This requires use of the -d option to specify an update delay.

UPDATE 2: On Raspbian, sysdig is not available and fatrace is broken.