What's causing all the disk activity on OS X?

59

39

Occasionally my Macbook Pro will slow down as the hard drive clicks away endlessly. CPU load is low, but applications and menuitems are slow to respond. Is there a utility that can help me determine what's going on, such as the number of bytes read/written or files open/closed per process, over time?

a paid nerd

Posted 2009-12-30T07:36:49.383

Reputation: 2 803

5Thanks for the suggestion regarding Spotlight. I was just now experiencing very high disk reads, threw my Boot Camp partition into the Privacy tab in Spotlight prefs, and immediately disk reads flatlined! Been driving me nuts for months. – Tim Keating – 2010-04-24T16:15:24.140

1Speculating here, but it might be something simple like mds updating Spotlight's index. – None – 2009-12-30T11:46:53.137

49 times out of 10 spotlight is the problem. One thing I've noticed is that if you have a bootcamp partition, be sure to include it on the spotlight blacklist or mds will seem to always be chewing on it. – Bryan Schuetz – 2009-12-30T16:18:02.187

Answers

61

From man iotop:

iotop tracks disk I/O by process, and prints a summary report that is refreshed every interval.

This is measuring disk events that have made it past system caches.

Since this uses DTrace, only the root user or users with the dtrace_kernel privilege can run this command.

This may not be precisely what you want - but it's a ksh script which wraps around dtrace, so you should be able to figure out how to make dtrace do what you need, if iotop doesn't handle it by default.

However, something like iotop -C 5 12 should give you something to start with: it will output 12 samples, each 5 seconds long.

James Polley

Posted 2009-12-30T07:36:49.383

Reputation: 5 892

2Pretty good. iotop -C 5 12 is a good way to get a summary of what's going on. – a paid nerd – 2009-12-31T18:01:04.260

51

You can also use fs_usage to get a blow-by-blow account of what apps are hitting the disk.

AlBlue

Posted 2009-12-30T07:36:49.383

Reputation: 611

1Oooh, this is hot. fs_usage also lets you filter network and filesystem activity. – a paid nerd – 2009-12-31T17:55:32.523

2

I always noticed this on Saturday mornings, and it turned out to be locate, which updates its database at 3:15am on Friday nights.

I tried disabling its launchd configuration (in /System/Library/LaunchDaemons/com.apple.locate.plist), but it still ran anyway, so I just moved /usr/libexec/locate.updatedb out of the way. Problem…mitigated.

Brandan

Posted 2009-12-30T07:36:49.383

Reputation: 121

1

It might be the OS paging to virtual memory instead of something application specific. You might try quitting less frequently used applications or at least restarting some applications that like to build up in-memory caches over time (e.g. Safari). Check out the various per-process memory statistics with Activity Monitor to find likely culprits. If quitting some memory intensive applications seems to temporarily alleviate the problem, you might try adding RAM.

If the disk activity is not paging related, you might be able to use fs_usage to track it back to one or more specific processes.

Chris Johnsen

Posted 2009-12-30T07:36:49.383

Reputation: 31 786