Home / ubuntu / Questions / 1330764
In Process
kellyvotrenom
Asked: 2021-04-12 11:15:36 +0800 CST

Is There A Way to Monitor Drive Access History?

  • 772

I occasionally get a burst of hard drive activity that lasts for 10-20 secs and then stops. I have seen some posts suggesting some sort of indexing might be going on but I don't know how to investigate this.

The problem usually - but not always - happens on coming out of sleep. There is brief period of intense activity and then it stops. It is on a system that has not changed much over the last 4-5 years and has just started recently, maybe the last 4-6 months.

Just installed fatrace but that seems to be only realtime, what I need is history with time stamps so I can see what accessed the disk at a certain time.

hard-drive

1 Answers

  1. My guess would be that this is caused by overdue cron jobs being started: There are a number of them that are supposed to run daily, weekly, monthly. Just look at /etc/cron.*:

    sh@balrog:~$ ls -ld /etc/cron.*
drwxr-xr-x 2 root root 4096 Apr 26  2018 /etc/cron.d
drwxr-xr-x 2 root root 4096 Apr  7 10:04 /etc/cron.daily
drwxr-xr-x 2 root root 4096 Apr 26  2018 /etc/cron.hourly
drwxr-xr-x 2 root root 4096 Apr 26  2018 /etc/cron.monthly
drwxr-xr-x 2 root root 4096 Jan  7 11:12 /etc/cron.weekly
sh@balrog:~$ ls -l /etc/cron.daily
total 56
-rwxr-xr-x 1 root root  311 Mai 29  2017 0anacron
-rwxr-xr-x 1 root root  376 Nov 20  2017 apport
-rwxr-xr-x 1 root root 1478 Apr 20  2018 apt-compat
-rwxr-xr-x 1 root root  314 Jan 17  2018 aptitude
-rwxr-xr-x 1 root root  355 Dez 29  2017 bsdmainutils
-rwxr-xr-x 1 root root 1176 Nov  2  2017 dpkg
-rwxr-xr-x 1 root root  372 Aug 21  2017 logrotate
-rwxr-xr-x 1 root root 1065 Apr  7  2018 man-db
-rwxr-xr-x 1 root root 6574 Apr  6 14:26 opera-browser
-rwxr-xr-x 1 root root  249 Jan 25  2018 passwd
-rwxr-xr-x 1 root root 3477 Feb 21  2018 popularity-contest
-rwxr-xr-x 1 root root  246 Mär 21  2018 ubuntu-advantage-tools
-rwxr-xr-x 1 root root  214 Jul 12  2013 update-notifier-common

    Back when it was really cron running those jobs (now it's probably using systemd timer units), that was supposed to run some time during the night when nobody would need that much computing power.

    But home or office PCs don't run during those night hours, so a fallback mechanism was created to have those background jobs run some time after the machine became active (after reboot or after resuming).

    Some of those jobs are done so quickly you hardly even notice them; others, like updating the locate database, might take a while.

    That particular one scans all filesystems on the off chance that you might want to use the locate command. It annoyed me enough to remove that package because I never use locate anyway (find is so much more powerful).

    What you described sounds very much like that same problem.

    Coming back to your specific question, catching those processes in the act is pretty difficult. When it starts, you can try our luck with the top command (or the GUI counterpart on your desktop) what unusual processes are active. But if they really do mostly disk I/O and little computing, you might not spot them.

    pstree might also be helpful because it shows the process hierarchy.

    There are also iotop and dstat (IMHO less helpful) and the old vmstat (never liked that one very much).

    • 0