Reads / writes by process to a specific file system

[Jim McKee_1]

Is there a way using Glance, MeasureWare, lsof, or another utility to determine which process(es) are reading or writing to a specific file system?

In Measureware reports by file system, I am seeing a high read rate at a time when there shouldn't be any activity on the file system. I would like to track this back to a process.

[Sandman!]

lsof would be helpful for this...invoke as:

# lsof -r | grep

this cmd will run lsof once every 15 seconds and will show you what processes are using that particular mount point/filesystem.

[Sandman!]

Don't need to pipe lsof's output into grep when you can do:

# lsof -r

~hope it helps

[Jim McKee_1]

losf shows the processes that have the file system opened, but doesn't indicate read or write activity.

[Sandman!]

After nailing down the specific process with lsof use the tusc(1) utility to trace the read and write syscalls issued by the particular PID, viz.,

# tusc -s read,write

[Patrick Wallek]

If you have the PID, then you can use Glance to see the details on that PID. If you are using the TUI glance, then hit a 'F' and put in the PID to see what files are open and what they are open for.

In the GUI glance (GPM) you highlight the process, then go to one of the reports (I can't recall which one right now) to see what all the process has open.