Take the 2-minute tour ×

Something is driving a lot of Disk I/O on my system lately. I can see in ActivityMonitor that there are huge volumes of reads and writes every second. But none of the "normal" suspects are active when this is happening. (i.e. it's not time machine.) and I have plenty of free memory (800MB to 1.3GB out of 6GB total) so it shouldn't be paging. I don't see any apps in top that are blocked on I/O when this starts. (once it's going then I see things start to pile up... but everything I see in there appears to be victim.)

What tools can I use to get a sense for what process is causing the disk io?

I think it started with 10.6.6. :( I don't recall ever hitting this with 10.6.5.

share|improve this question
When does this start? Does it seem to be triggered as soon as you turn on the computer, or is it when you open a certain application? –  Nathan Greenstein Jan 17 '11 at 15:45
There's no sane pattern I've found yet. When I posted this this morning I had woken up the system about 45 min prior and had the same dozen or so processes running that had been running for days. It seems to happen about every 3 or 4 days, I'll comment on what it is once I catch it with Gordon's solution. –  cabbey Jan 17 '11 at 21:29
I think Activity Monitor is useless -- I also need to know what is going on with this I/O stuff. Apple can surely come up with something more than Activity Monitor to tell me what is going on with my MacPRO (10.6.6). I did buy MacScan and found that it stopped a lot of activity in the form of spyware...something to consider...I configure MacScan to run every 24 hrs at midnight. Now I am no longer losing bandwidth under my Hughesnet Satellite limitations. –  drellenr Jan 18 '11 at 3:41
Mystery solved thanks to iotop. It was a network client (a virtual windows test box) that had mounted my home directory and appears to have been doing some kind of indexing or scanning or something. I went and disconnected the share from the wintendo side and it stopped grinding my raid array immediately. –  cabbey Jan 20 '11 at 21:54
add comment

2 Answers

up vote 8 down vote accepted

Try sudo iosnoop; it shows I/O as it happens, including the process ID and process name doing the I/O, as well as data size, file path, etc. There are options to restrict it to only show a certain device, mount point, process, etc.

share|improve this answer
and from iosnoop's man page, iotop is even better! thanks!! –  cabbey Jan 17 '11 at 21:26
@cabbey I hadn't noticed iotop before; thanks for the pointer. –  Gordon Davisson Jan 17 '11 at 22:55
add comment

On *nix systems lsof is used for checking to see what app has what file open. It's a good starting point for digging around.

Type man lsof at the commend line to see if its description sounds useful.

Also, open the "console" app, or tail -f some of the /var/log files that show a lot of activity, and see if something is broken or complaining.

share|improve this answer
While LSOF is great for some things, like why can't I unmount/eject this media, it's not so useful here. Showing me what files are OPEN is pointless, there's thousands of open files at all times. I need to know what ones are being read/written to. –  cabbey Jan 17 '11 at 23:24
add comment

Your Answer


