I was investigating a problem on a Mac OS X 10.6.8 Server, where users were complaining of access slowdowns. Network throughput slowed to a crawl. It felt like the server was overburdened. System metrics showed the data rate at the NIC to be under 10MBps, while the web management interface for the Promise VTrak 610fD RAID chassis showed 40MBps. The chassis showed 8500 IOPS for one array.
Using fs_usage, I observed AppleFileService doing a RdMeta on a particular HFS+J volume at an excessive rate.
13:48:05.783 RdMeta D=0x00009fc9 B=0x1000 /dev/disk6s2 0.000095 W AppleFileServer
13:48:05.783 RdMeta D=0x00009fca B=0x1000 /dev/disk6s2 0.000097 W AppleFileServer
13:48:05.783 RdMeta D=0x00009fcb B=0x1000 /dev/disk6s2 0.000096 W AppleFileServer
The problem was resolved when I temporarily ceased sharing the volume on disk6. I would like to know what data are associated with these disk block numbers (40905, 40906, 40907, etc) on the device listed.
What tools can I use to identify the file(s) associated with these blocks?
Off the top of my head, I can't think of a simple way to figure that out with the tools included in Mac OS X, but you can do it with fileXray, the powerful commercial HFS+ forensics command-line tool from iohead (I've tested and confirmed this myself, and it works like a charm):
Even if you decide not to buy their powerful software, the freely available manual gives some interesting insights into the low-level details of HFS+ etc.