Find what program/process is writing to disk and what file it is writing to [duplicate]

Solution 1:

Update from a reader's comment

You can install and use fatrace. It is a small command line utility that enables you to view the process that is reading/writing to a file. Install it with

sudo apt-get install fatrace

Run it in a terminal with sudo fatrace. It will show you information in auto-scrolling fashion like this

rsyslogd(971): W /var/log/syslog
rsyslogd(971): W /var/log/mail.log
rsyslogd(971): W /var/log/mail.log
rsyslogd(971): W /var/log/mail.err
rsyslogd(971): W /var/log/mail.err
ruby(5094): R /home/anwar/..../config/initializers
ruby(5094): RC /home/anwar/..../config/initializers
ruby(5094): O /home/anwar/..../config/initializers
ruby(5094): R /home/anwar/..../config/initializers
ruby(5094): RC /home/anwar/..../config/initializers

[.... are input by me.]

• The first column include the name of the process and it's process id in brackets like ruby(5094) followed by a :.

• The second column is the event type indicator. The event types are there - (from man page)

  Open, Read, Write, or Close. Combinations are possible, such as CW for closing a written file.

• The last column is the file involved in the operation with full path name.

Use iotop program. To install it, use terminal with the command

sudo apt-get install iotop

or using this link iotop

and then use sudo iotop in a terminal to see the programs using your disk.

To open a terminal, use Ctrl + Alt + T keyboard shortcut