How can I track HDD access? Not in a monitoring sense of MB/s like iotop
. My internal mass storage HDD gets permanently woken up and I want to find the evil process with an absolute list of accesses.

- 369,824

- 4,376
-
On Linux, you can have a look at fatrace – Stéphane Chazelas Jul 04 '14 at 18:28
-
Isn't there a "native" tool? I'd thought this was somehow core functionality? – ManuelSchneid3r Jul 04 '14 at 23:33
1 Answers
Take a look at this U&L Q&A titled: Amazon EC2 micro instance large number of IO requests, where I provide details around a tool called fatrace
. I also cover it in this Q&A titled: Determining Specific File Responsible for High I/O.
fatrace
This is a new addition to the Linux Kernel and a welcomed one, so it's only in newer distros such as Ubuntu 12.10. My Fedora 19 system also has access to it.
It provides the same access that you can get through inotify without having to target a particular directory and/or files.
$ sudo fatrace
pickup(4910): O /var/spool/postfix/maildrop
pickup(4910): C /var/spool/postfix/maildrop
sshd(4927): CO /etc/group
sshd(4927): CO /etc/passwd
sshd(4927): RCO /var/log/lastlog
sshd(4927): CWO /var/log/wtmp
sshd(4927): CWO /var/log/lastlog
sshd(6808): RO /bin/dash
sshd(6808): RO /lib/x86_64-linux-gnu/ld-2.15.so
sh(6808): R /lib/x86_64-linux-gnu/ld-2.15.so
sh(6808): O /etc/ld.so.cache
sh(6808): O /lib/x86_64-linux-gnu/libc-2.15.so
The above shows you the process ID that's doing the file accessing and which file it's accessing, but it doesn't give you any overall bandwidth usage, so each access is indistinguishable to any other access.
NOTE: fatrace
can take a -p PID
argument so you can direct it to watch a single PID if you want instead.