How to find which process is currently writing to the disk?

Question

For some unknown reason there is no space left on my /, even 5 minutes after removing 300 MBs of junk packages, there is no space left again. So I've come to conclusion that there is some process that floods my disk space. (--> Recently I installed docker).

How can I find which process produces most data on /?

See also Is it possible to find out what program or script created a given file?, where all solutions can easily be adapted to watch a directory tree rather than a single file. But in your case this will produce a lot of false positive, terdon's method is likely to work better. — Gilles 'SO- stop being evil', Mar 22 '15 at 18:07

score 5 · Accepted Answer · answered Mar 22 '15 at 13:40

Your best bet is probably iotop:

   iotop  watches  I/O  usage  information  output  by  the  Linux  kernel
   (requires 2.6.20 or later) and displays a table of current I/O usage by
   processes   or   threads   on   the   system.   At   least   the   CON‐
   FIG_TASK_DELAY_ACCT,  CONFIG_TASK_IO_ACCOUNTING,  CONFIG_TASKSTATS  and
   CONFIG_VM_EVENT_COUNTERS  options need to be enabled in your Linux ker‐
   nel build configuration.

Assuming your process is doing a lot of I/O operations, it should show up pretty high in that list.

How to find which process is currently writing to the disk?

1 Answers1