2

I have a debian stable server and I am trying to find a process which wake-up every hour at exactly xh22 (1h22, 2h22, 3h22, etc...) and write something to the disk. However I cannot find the process, nor what it is writing (I know something is written up as the disk is spinning up).

I cleared the cron.hourly, deactivate the kernel logging ($ModLoad imklog in /etc/rsyslog.conf), activated the block_dump (echo 1 > /proc/sys/vm/block_dump) and monitored disk access (watch "dmesg -c >> /tmp/mytemp/trace.txt").

Every hour I can see lines like these:

[2013-05-29 01:22:03] jbd2/sda1-8(224): WRITE block 25459816 on sda1 (8 sectors)
[2013-05-29 01:22:03] jbd2/sda1-8(224): WRITE block 25459824 on sda1 (8 sectors)
[2013-05-29 01:22:03] jbd2/sda1-8(224): WRITE block 25459832 on sda1 (8 sectors)
[2013-05-29 01:22:03] jbd2/sda1-8(224): WRITE block 25459840 on sda1 (8 sectors)
[2013-05-29 01:22:03] jbd2/sda1-8(224): WRITE block 25459848 on sda1 (8 sectors)
[2013-05-29 01:22:03] jbd2/sda1-8(224): WRITE block 25459856 on sda1 (8 sectors)
[2013-05-29 01:22:03] jbd2/sda1-8(224): WRITE block 25459864 on sda1 (8 sectors)
[2013-05-29 01:22:05] jbd2/sda1-8(224): WRITE block 25459872 on sda1 (8 sectors)

But I cannot find what is being written:

debugfs /dev/sda1
debugfs 1.42.5 (29-Jul-254598162012)
debugfs:  icheck 25459816
Block   Inode number
25459816   <block not found>

Can someone help me tracking this process ? I think it is not the journalling filesystem (sda1 is an ext4 partition with noatime).

Or maybe someone can give me a general approach to track what is being written on disk ?

Thanks !

SaintGermain
  • 21
  • 4

1 Answers1

0

You can use iotop to see which processes are using the disk.

http://guichaz.free.fr/iotop/

Cha0s
  • 2,462
  • 2
  • 16
  • 26
  • iotop only shows jbd2/sda1-8. block_dump, at least, is providing the block number which is written. – SaintGermain May 29 '13 at 13:34
  • jbd2 is not a process actually. It's the journaling block device of ext4. https://en.wikipedia.org/wiki/Journaling_block_device This may be helpful. http://ubuntuforums.org/showthread.php?t=2014443&p=12115802#post12115802 Quote: "I finally came across a tid bit of information stating that when you format an ext4 partition it's basically a 'quick' format...and over time it slowly 'formats' the rest of the drive." – Cha0s May 29 '13 at 13:51
  • The disk is quite small, was formatted more than one month ago and is powered on 24h/day, 7 days/week. So I don't think that it is the problem here. jbd2/sda1-8 is called every time a process is writing on disk. Most processes leave their name with block_dump (just before the call to jbd2/sda1-8) except this mysterious one. – SaintGermain May 29 '13 at 15:21
  • I know its been while but I'm stuck with the same problem on a system running from a SD card. I would relaly like to figure this one out cause jbd2 is the only thing left still writting to the disk. Everything else uses tmpfs. Did you manage to find any more info on the subject? – TCZ8 Apr 29 '15 at 14:08