How can I tell what's spinning up my drive?

I have enable "spindown" on one of my Linux server's drives, which is only accessed by a BitTorrent client - meaning, when I don't have torrents running, nothing else should be accessing the disk and waking it up from spindown (right?).

But something is making the disk spin up every 15 minutes or so. How can I track the rogue culprit?

Thanks for any feedback!

You can check out http://samwel.tk/laptop_mode/ . Although this page is not primarly about your problem, but gives a good overall picture how IO works and ideas, how to silent your disks by shutting them off.

The short answer for your problem:

echo 1 > /proc/sys/vm/block_dump

it will produce messages in syslog like:

Jul 23 10:04:05 locutus kernel: ls(5224): READ block 7340136 on dm-4
Jul 23 10:04:05 locutus kernel: ls(5224): READ block 4335136 on dm-4
Jul 23 10:04:05 locutus kernel: ls(5224): READ block 15505568 on dm-4
Jul 23 10:04:05 locutus kernel: ls(5224): READ block 7340160 on dm-4
Jul 23 10:04:05 locutus kernel: ls(5224): READ block 7340168 on dm-4

I've used a simple ls command

NOTE: be sure your system logging is shut off or written to a ramdisk (type: tmpfs) before doing so, because (quote): "your system may get into a feedback loop, where syslogd causes disk activity, this causes kernel output, and this causes syslogd to do more disk activity"

I recommend mounting /tmp as a ramdisk then setting up logging to /tmp/syslog. This in /etc/fstab (and a reboot) will do:

none /tmp tmpfs defaults,size=256M 0 0

In Linux, the recent-ish fanotify syscall enabled a nice utility called fatrace that informs on which process is hitting which file either for the whole system or a particular partition. Definitely my favourite tool for this sort of thing:

deluged(6542): R /usr/share/GeoIP/GeoIP.dat
rsyslogd(1737): W /var/log/syslog
rsyslogd(1737): W /var/log/kern.log

I have been using iotop to figure out what is using the drive. From the website you must have "Linux kernel ≥ 2.6.20 with the TASK_DELAY_ACCT and TASK_IO_ACCOUNTING options enabled".

It sounds like you are just interested in one particular drive. You might consider writing a script that routinely check with lsof or fuser for access to that drive/partition.