Is there a way to really get at the source of ongoing internal disk I/O?

Question

On Mountain Lion, I&#x27;m noticing that the hard drive is being accessed considerably - I can hear it.  As if it&#x27;s some big sync or a big write to disk.  And yet Activity Monitor shows very little - just a few little spikes in disk I/O when this happens.  Since I can&#x27;t identify a single application that would be causing that, I thought it might be swapping to disk.  But there&#x27;s 8GB on my MacBook Pro and I&#x27;m only using 1GB or so, as I have all applications closed but Terminal and a Safari using around 300MB or so.  I had thought that it was mds that was consuming the I/O, but I disabled that temporarily and found the same I/O patterns.  I see that there are no major processes running that are using more than 20% or so, via top, and I&#x27;ve also run iotop and fs_usage, which are either uninformative or provide way too much information.  I&#x27;m very concerned that I&#x27;ll eventually harm the hard drive if I&#x27;m accessing it literally all the time, and I&#x27;m certainly using a lot more battery if it&#x27;s writing in these patterns.  It could be a lot of things, but what I&#x27;d like to know is how can I best find out what&#x27;s going on.  It seems to be something internal.  Is there a better tool to get at what&#x27;s going on?  Some filter I can apply to the existing tools?

ivansky · Answer

Extracting this type of information can be difficult, especially when there is no big ticket item that shows up easily in diagnostic output.  I am not an OS X guru in this area, but since no-one else has replied to your post I thought I would at least comment from the perspective of a long time UNIX admin.  If you have already explored iotop and fs_usage, then it seems to me that you are on the right track.  Perhaps your disk is just more noisy than you expect.  If you can&#x27;t find it using these low level commands, maybe there is nothing to find?  As far as background disk IO is concerned, Time Machine is an obvious choice, but you seem to be talking about your internal disk, so presumably that&#x27;s not it.Is your disk very full?  I have had issues with fragmentation when I filled my disk too much, and perhaps your issue could be related to that.  The general recommendation is that you need at least 10% of your disk free, although more free space is always better.One other suggestion I can offer is that you may find lsof helpful, in that it may identify a file being written to which could help in tracking down disk IO.  I&#x27;ve had good experiences with an app called "Rubbernet" that uses lsof to produce a graphical display of network traffic - perhaps running that would identify processes transferring data that are causing the disk IO?I&#x27;m also assuming you&#x27;re not running any type of BitTorrent client, as this could explain background disk IO too of course.Sorry I couldn&#x27;t offer anything more specific.  I hope some of those ideas help you.Ivan

xb37835dd237610f1 · Answer

Thanks for the feedback.  I wanted to reply to your questions and suggestions.  The sound I&#x27;m hearing is much like what I&#x27;d hear if I did "while true; do sync; done" or maybe two "dd if&#x3D;/dev/zero of&#x3D;/dev/rdiskX bs&#x3D;16777216 &amp;" command interspersed by a half a minute.  It seems to be seeking back and forth.  I would have guessed swap.  I&#x27;ve explored iotop and fs_usage but maybe there&#x27;s a way to better hone in on the right information.  And maybe they don&#x27;t really provide information on system I/O.  The memory information at the top of top didn&#x27;t seem to suggest anything too far out of the ordinary.It&#x27;s a new disk and there are times when it&#x27;s not accessing at all - so it does go silent for a while.  When it does have this seeking pattern it seems to be very distinct.  It just seems to want to read/write a lot of data, as if it&#x27;s run out of memory and needs to swap.  But I&#x27;m not experiencing any kind of significant latency in the UI.  I don&#x27;t have Time Machine activated as client or server anywhere, and it is the internal disk.  Also the disk has over 200GB free, and it&#x27;s also a new disk.  I tried a big lsof but didn&#x27;t see anything that stood out.  And I&#x27;m not running any applications which would create this kind of I/O.  I only run Safari, Terminal, and Emacs in normal usage, and in Terminal I&#x27;ll run things like screen and ssh.  Plus I do not install extensions or unnecessary kernel modules.At the moment I listen to the I/O and it&#x27;s really constant - it&#x27;s like there&#x27;s this big dd in the background or constant swapping but I can see that this is not the case.  Any further ideas on how to hone in on what&#x27;s going on would be appreciated.