Re: finding the perpetrator of regular disk I/O

[Brett Lymn <blymn%baea.com.au@localhost>]

On Thu, Mar 24, 2011 at 05:53:27PM +0000, Taylor R Campbell wrote:
> 
> Summary: I'm observing frequent disk I/O for no apparent reason under
> a current kernel, but not under a 5.1_STABLE kernel.  How can I find
> what part of the system is doing the disk I/O (iostat doesn't tell me
> the process, for instance), and how do I make it stop?  I would like
> to know how to find sources of disk I/O in general, and also to fix
> this particular case.
> 

What you can do is load up a blank fingerprint file into veriexec and
set that to run in monitor mode only.  That will log every exec for you
since the fingerprint won't match.  It is not what veriexec is intended
for but it will provide the information, I did exactly this when I was
trying to do the same thing with idling the disk on my laptop.

-- 
Brett Lymn
"Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited.  If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility.  It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer."