What's causing all the disk activity on OS X?

Solution 1:

From man iotop:

iotop tracks disk I/O by process, and prints a summary report that is refreshed every interval.

This is measuring disk events that have made it past system caches.

Since this uses DTrace, only the root user or users with the dtrace_kernel privilege can run this command.

This may not be precisely what you want - but it's a ksh script which wraps around dtrace, so you should be able to figure out how to make dtrace do what you need, if iotop doesn't handle it by default.

However, something like iotop -C 5 12 should give you something to start with: it will output 12 samples, each 5 seconds long.

Solution 2:

You can also use fs_usage to get a blow-by-blow account of what apps are hitting the disk.

Solution 3:

I always noticed this on Saturday mornings, and it turned out to be locate, which updates its database at 3:15am on Friday nights.

I tried disabling its launchd configuration (in /System/Library/LaunchDaemons/com.apple.locate.plist), but it still ran anyway, so I just moved /usr/libexec/locate.updatedb out of the way. Problem…mitigated.