How can I record what process or kernel activity i

Question

On a particular Debian server, iostat (and similar) report an unexpectedly high volume (in bytes) of disk writes going on. I am having trouble working out which process is doing these writes.

Two interesting points:

1. Tried turning off system services one at a time to no avail. Disk activity remains fairly constant and unexpectedly high.

2. Despite the writing, do not seem to be consuming more overall space on the disk.

Both of those make me think that the writing may be something that the kernel is doing, but I'm not swapping, so it's not clear to me what Linux might try to write.

Could try out atop:

http://www.atcomputing.nl/Tools/atop/

but would like to avoid patching my kernel.

Any ideas on how to track this down?

Answer 1

I've recently heard about Mortadelo, a Filemon clone, but have not checked it out myself yet:

http://gitorious.org/mortadelo

Answer 2

You could also use htop, enabling IO_RATR column. Htop is an exelent top replacement.