How do I find which Linux process is generating disk I/O?
Per-process I/O sampling helps connect device pressure to a workload, but it is not a direct one-to-one map of every physical write. Caching, delayed writeback and filesystem activity can separate the process that generated data from the moment storage becomes busy. Use process and device evidence together.
Before you start
- sysstat is installed and process inspection is authorised.
Instructions
1. Sample active process I/O
The sysstat package provides pidstat. Administrative permission may be needed to inspect all processes in a restricted environment.
pidstat -d -p ALL 1 5Read and write rates identify candidate workloads over five intervals. Confirm the command’s units and whether permission restrictions hide processes.
2. Confirm the candidate identity
Replace the sample PID with one observed during the incident. Prefer compact identity fields over full arguments, which might expose sensitive connection parameters.
ps -p 12345 -o pid,ppid,user,lstart,commMap the process to its service, scheduled task or container before proposing any change. PIDs can be reused after exit.
Check the result
- The high-I/O process is tied to the intended workload and its activity correlates with device latency and the user-visible slowdown.
Troubleshooting
- No process accounts for all device writes
- Consider kernel writeback, filesystem metadata, RAID activity, short-lived processes or visibility restrictions.
- A legitimate batch job is responsible
- Coordinate scheduling, limits or application tuning; do not kill it solely because it appears at the top of a list.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.