How do I find a file on Linux in an ext4 filesystem that's being written to frequently?

Question

I've got a Ubuntu system which is writing a block to disk every 1-2 seconds. Some kind of log accruing an error. How do I find which file it is?

I've been poring over lsof output and tailing suspects with no luck. Is there a way to find it, really find it?

What makes you think something is writing to the disk every 1 -2 seconds? Are you basing this off the drive LEDs? It can be very tricky to get Linux to minimize writes to the disk. Some disk flushes happen automatically every few seconds. — mfarver, May 15 '11 at 20:00

score 8 · Answer 1 · answered May 14 '11 at 21:40

8

Maybe you can check which process is writing frequently to disk with iotop, then spy this process with strace.

answered May 14 '11 at 21:40

Cédric Julien

391
6
12

yea, iotop, that's the ticket, looks like it's just jbd2 .... – May 14 '11 at 21:52

score 6 · Answer 2 · answered May 14 '11 at 21:41

6

You could use inotifywatch(1). Something like this should get you closer

inotifywatch -v -e modify  -r /root

answered May 14 '11 at 21:41

Interesting. I was not familiar with that command. – ewwhite May 15 '11 at 22:42

score 1 · Answer 3 · answered May 14 '11 at 21:51

1

Besides the other answers, you could also try just using find / -mtime -1 to list files recently modified.

answered May 14 '11 at 21:51

Zach Kelling

374
3
5

score 1 · Answer 4 · answered May 15 '11 at 18:28

1

I've done iostat to find what disk was getting the access, then lsof|grep to find files, perhaps look at what looks like log files, filter out tcp or something.

answered May 15 '11 at 18:28

lsd

1,673
10
10

How do I find a file on Linux in an ext4 filesystem that's being written to frequently?

4 Answers4