When HDD wakes up?

Solution 1:

In order to find out what files are being accessed (which may help narrow down the process responsible), you can try using inotifywatch which can be set up to recursively watch directories below a directory you choose. Be sure to read the warnings in the man page regarding using --recursive on a large tree.

When a filesystem event occurs in a directory in that tree, it is recorded and output in a table. You can use --timeout to limit the amount of time that the watch is active.

If the results are consistent, you can run a non-recursive watch on the files in that directory to narrow down the particular file.

Solution 2:

See this ubuntu bug report on how to track that down (and a possible cause).

Short answers: auditctl -w /dev/sdX -p rwa and udisks

Solution 3:

As you are on linux, you can use the new fatrace utility, which logs every file access and tells you which process is responsible:

https://launchpad.net/fatrace

More information here:

http://www.piware.de/2012/02/fatrace-report-system-wide-file-access-events/

It makes use of the linux fanotify API (more details) available since linux kernel 2.6.37.

fatrace isn't packaged by most distributions as of July 2014 (it entered debian testing recently, so should ship in 'jessie'), but is easy to install from source.