I have some process(es) performing a lot of drive access from time to time, however I've hitherto been unable to isolate which process or processes are performing the access. What shell command can I issue to isolate the most disk access intensive processes?


After fiddling with making my own solution via fs_usage manipulation, I discovered the DTrace iotop script (man iotop). This really seems to do the trick with regards to giving samples of filesystem activity at nice updated intervals and quickly allows one to isolate possibly misbehaving processes.

*NOTE: you must run it with sudo or as root user.

For example:

sudo iotop -C 5   # Simply gives an update every 5 seconds in default output format without clearing screen.
sudo iotop -CP 2  # Gives 2 second interval updates w/o clearing screen and I/O time based output.


iotop [-C] [-D|-o|-P] [-j|-Z] [-d device] [-f filename] [-m mount_point] [-t top] [interval [count]]

   -C     don't clear the screen
   -D     print delta times - elapsed, us
   -j     print project ID
   -o     print disk delta times, us
   -P     print %I/O (disk delta times)
   -Z     print zone ID
   -d device
          instance name to snoop (eg, dad0)
   -f filename
          full pathname of file to snoop
   -m mount_point
          mountpoint for filesystem to snoop
   -t top print top number only
  • 1
    The other very useful commands to focus in on what is happening are DTrace based rwsnoop and iosnoop – The Tentacle Oct 29 '12 at 18:36
  • Yes @TheTentacle, I've used iosnoop a lot, but generally found fs_usage to be faster. Will have to play with rwsnoop, thanks. – ylluminate Oct 29 '12 at 22:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .