What files are being updated or written in /dev/sda?

Question

root@host [/etc]# iostat -xk
Linux 2.6.32-279.19.1.el6.x86_64 (host.superhostsite.com)       01/13/2013      _x86_64_        (24 CPU)

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
          12.53    0.19    3.72    0.18    0.00   83.38

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s avgrq-sz avgqu-sz   await  svctm  %util
sda               0.24   252.39   13.95    4.24   381.61  1026.56   154.88     1.35   73.99   1.67   3.04
sdb               0.00    12.88   62.55  134.82   755.65  1146.14    19.27     0.82    4.17   0.10   1.92
sdc               0.01   129.31   28.19  298.49   451.10  1711.38    13.24     0.21    0.63   0.05   1.75

root@host [/etc]# mount
/dev/sda3 on / type ext4 (rw,noatime,noload,data=ordered,commit=10)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw,rootcontext="system_u:object_r:tmpfs_t:s0")
/dev/sda1 on /boot type ext4 (rw)
/dev/sdb1 on /home2 type ext2 (rw,noatime)
/dev/sdc1 on /home3 type ext4 (rw,noatime,noload,data=ordered,commit=10)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
/usr/tmpDSK on /tmp type ext3 (rw,noexec,nosuid,loop=/dev/loop0)
/tmp on /var/tmp type none (rw,noexec,nosuid,bind)
root@host [/etc]#

1026 wKB/s and 73 seconds wait. What is being written there? It makes the whole server slow.

SDA is the only drive that is not SSD. This could be the bottle neck.

One approach I am thinking is to do solution in How to know recently updated files

However, sda, being the root, is mounted at /

there are files in sdb and sdc that are written but I don't care about them.

iotop -o -a yields

Total DISK READ: 1314.41 K/s | Total DISK WRITE: 3.58 M/s
  TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN     IO>    COMMAND
13266 be/4 root          0.00 B      2.22 M  0.00 %  0.67 % [flush-8:16]
  880 be/3 root          0.00 B    144.00 K  0.00 %  0.61 % [jbd2/sda3-8]
 1778 be/4 root          0.00 B      0.00 B  0.00 %  0.08 % [kjournald]
  940 be/4 root          0.00 B   1024.00 K  0.00 %  0.04 % [flush-8:32]
26823 be/4 nudenude     24.00 K    300.00 K  0.00 %  0.01 % php /home2/nudenude/public_html/hello/index.php
 1775 be/0 root          0.00 B     56.00 K  0.00 %  0.00 % [loop0]
27273 be/4 nudenude      8.00 K    360.00 K  0.00 %  0.01 % [php]
  128 be/4 root          0.00 B      4.00 K  0.00 %  0.00 % [sync_supers]
 8414 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL
24938 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
24997 be/4 nobody        0.00 B     16.00 K  0.00 %  0.00 % httpd -k start -DSSL
25068 be/4 nobody        0.00 B     12.00 K  0.00 %  0.00 % httpd -k start -DSSL
25070 be/4 nobody        0.00 B     12.00 K  0.00 %  0.00 % httpd -k start -DSSL
25074 be/4 nobody        0.00 B     16.00 K  0.00 %  0.00 % httpd -k start -DSSL
25075 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
25076 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL
 4215 be/4 root          0.00 B      4.00 K  0.00 %  0.00 % whostmgrd - serving 139.193. --llu=1357836602 --listen=3,4,5,6,7,8
 4117 be/4 nobody        0.00 B     12.00 K  0.00 %  0.00 % httpd -k start -DSSL
21264 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
25398 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
17226 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
21331 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
21332 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
17290 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL
17296 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
  938 be/4 root          0.00 B     24.00 K  0.00 %  0.00 % [flush-8:0]
17358 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL
21467 be/4 nobody        0.00 B     20.00 K  0.00 %  0.00 % httpd -k start -DSSL
17372 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL
21470 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL
21471 be/4 nobody        0.00 B     16.00 K  0.00 %  0.00 % httpd -k start -DSSL
17377 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL
17381 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL
17465 be/4 nobody        0.00 B     12.00 K  0.00 %  0.00 % httpd -k start -DSSL
17467 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
17483 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
17492 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
17501 be/4 nobody        0.00 B     12.00 K  0.00 %  0.00 % httpd -k start -DSSL
17507 be/4 nobody        0.00 B      4.00 K  0.00 %  0.00 % httpd -k start -DSSL
17509 be/4 nobody        0.00 B      8.00 K  0.00 %  0.00 % httpd -k start -DSSL

/dev/sda is not root, in your list you can see that /dev/sda3 is mounted to /. /dev/sda is just the whole disk. Programs like fdisk use that device node. — ott--, Jan 14 '13 at 08:58

score 1 · Answer 1 · answered Jan 14 '13 at 04:34

1

If you are actually seeing it happening, use iotop.

answered Jan 14 '13 at 04:34

John Siu

4,765

Karthik T · Accepted Answer · 2013-01-14T07:37:07.230

1

You want to use find as specified in your link, but with an additional -mount flag, that will restrict find to the current filesystem, and ignore any others.

-mount
Don't descend directories on other filesystems. An alternate name for -xdev, for compatibility with some other versions of find.

edited Jan 14 '13 at 07:37

answered Jan 14 '13 at 04:49

Karthik T

924
6
13

let me try sounds good. – user4951 Jan 14 '13 at 09:01

What files are being updated or written in /dev/sda?

2 Answers2