|
Home > Archive > Unix Programming > March 2006 > what's writing to my hard disks?
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
what's writing to my hard disks?
|
|
| goldfita@signalsguru.net 2006-03-19, 12:02 pm |
| Hi,
I have an array of hard disks and it's being accessed every few
seconds. The noise is driving me crazy. It appears to be ndiswrapper.
I'd like to figure out if there is any way to stop it from using the
hard disks (at least when I'm not using ethernet). So I need to know
what it's writing. I took a look in /var/log and didn't notice
anything. I tried 'strace -p 1225' and also 1224 as root. The
processes were ndis_wq and wrapper_wq, which seemed promising. I got
'attach: ptrace(PTRACE_ATTACH, ...): Operation not permitted'. Not
sure what the issue is...
Any suggestions? I'm on a linux machine. I would just put in a normal
ethernet card, but I'm out of slots. Thanks.
| |
| Logan Shaw 2006-03-19, 12:02 pm |
| goldfita@signalsguru.net wrote:
> I have an array of hard disks and it's being accessed every few
> seconds. The noise is driving me crazy. It appears to be ndiswrapper.
> I'd like to figure out if there is any way to stop it from using the
> hard disks (at least when I'm not using ethernet). So I need to know
> what it's writing. I took a look in /var/log and didn't notice
> anything. I tried 'strace -p 1225' and also 1224 as root.
I can think of three easy ways to find clues. They are not bulletproof
methods, but they're easy:
1. Let the machine otherwise be completely idle. Then run "top".
Whatever programs are using disk must also be using at least a
little CPU time as well, if for nothing else but to call read()
and/or write().
2. Similar principle to #1: run "ps auxwwr" over and over and
over. It only shows processes that are in the running (or
disk wait) state, and hopefully you will catch the offending
processes while they are writing.
3. Do this:
touch /tmp/foo
sleep 60
find / -newer /tmp/foo -print
That will show you all the files modified in the last 1 minute.
One of the files being created should be in the list.
Hope that helps.
- Logan
| |
| Pascal Bourguignon 2006-03-19, 12:02 pm |
| goldfita@signalsguru.net writes:
> I have an array of hard disks and it's being accessed every few
> seconds. The noise is driving me crazy. It appears to be ndiswrapper.
> I'd like to figure out if there is any way to stop it from using the
> hard disks (at least when I'm not using ethernet). So I need to know
> what it's writing. I took a look in /var/log and didn't notice
> anything. I tried 'strace -p 1225' and also 1224 as root. The
> processes were ndis_wq and wrapper_wq, which seemed promising. I got
> 'attach: ptrace(PTRACE_ATTACH, ...): Operation not permitted'. Not
> sure what the issue is...
>
> Any suggestions? I'm on a linux machine. I would just put in a normal
> ethernet card, but I'm out of slots. Thanks.
Try: cat /proc/mdstat (on Linux; find the equivalent for your OS).
The first step in a disk array, is to "build" it, that is, to actually
initiallize all the sectors of the array.
For a RAID-1, it means copying all the sector of the main to the mirrors.
For a RAID-5 or 6, it means computing the syndromes for all the blocks.
This can take several hours on big disks.
It's needed the first time, and after a crash that left the disks
unsynchronized.
Once it's done (you see in /proc/mdstat there's no rebuilding in
process), there remains only the normal logs and accesses.
If your file systems are not mounted with the noatime flag, then
everytime you access a directory or a file, the access time is
updated. In a RAID-5/6, that means that a block is read from all
disks, and one block is written on two (or more) of them.
Then, there are the crontabs, the atjobs, and all the servers (http,
ftp, smtp, etc).
--
__Pascal Bourguignon__ http://www.informatimago.com/
You're always typing.
Well, let's see you ignore my
sitting on your hands.
| |
| goldfita@signalsguru.net 2006-03-19, 12:02 pm |
|
Logan Shaw wrote:
> goldfita@signalsguru.net wrote:
>
> I can think of three easy ways to find clues. They are not bulletproof
> methods, but they're easy:
>
> 1. Let the machine otherwise be completely idle. Then run "top".
> Whatever programs are using disk must also be using at least a
> little CPU time as well, if for nothing else but to call read()
> and/or write().
>
> 2. Similar principle to #1: run "ps auxwwr" over and over and
> over. It only shows processes that are in the running (or
> disk wait) state, and hopefully you will catch the offending
> processes while they are writing.
>
> 3. Do this:
>
> touch /tmp/foo
> sleep 60
> find / -newer /tmp/foo -print
>
> That will show you all the files modified in the last 1 minute.
> One of the files being created should be in the list.
>
> Hope that helps.
>
> - Logan
Thanks. I tried that last trick and got back a lot of output from
/sys/devices. It's clearly coming from my wireless/usb device
(driver). I'm not sure what's in /sys, but I get the impression they
aren't regular files.
| |
| Maxim Yegorushkin 2006-03-19, 12:02 pm |
|
goldfita@signalsguru.net wrote:
> Hi,
>
> I have an array of hard disks and it's being accessed every few
> seconds. The noise is driving me crazy. It appears to be ndiswrapper.
> I'd like to figure out if there is any way to stop it from using the
> hard disks (at least when I'm not using ethernet). So I need to know
> what it's writing.
This might be of help:
linux-2.6.14/Documentation/laptop-mode.txt
....
If you want to find out which process caused the disk to spin up, you
can
gather information by setting the flag /proc/sys/vm/block_dump. When
this flag
is set, Linux reports all disk read and write operations that take
place, and
all block dirtyings done to files. This makes it possible to debug why
a disk
needs to spin up, and to increase battery life even more. The output of
block_dump is written to the kernel output, and it can be retrieved
using
"dmesg". When you use block_dump and your kernel logging level also
includes
kernel debugging messages, you probably want to turn off klogd,
otherwise
the output of block_dump will be logged, causing disk activity that is
not
normally there.
| |
| Frank Cusack 2006-03-19, 12:02 pm |
| On 18 Mar 2006 12:43:04 -0800 goldfita@signalsguru.net wrote:
> Hi,
>
> I have an array of hard disks and it's being accessed every few
> seconds. The noise is driving me crazy. It appears to be ndiswrapper.
> I'd like to figure out if there is any way to stop it from using the
> hard disks (at least when I'm not using ethernet). So I need to know
> what it's writing. I took a look in /var/log and didn't notice
> anything. I tried 'strace -p 1225' and also 1224 as root. The
> processes were ndis_wq and wrapper_wq, which seemed promising. I got
> 'attach: ptrace(PTRACE_ATTACH, ...): Operation not permitted'. Not
> sure what the issue is...
ahh, the infamous process 1225
> Any suggestions? I'm on a linux machine. I would just put in a normal
> ethernet card, but I'm out of slots. Thanks.
I know this doesn't help you, but this is trivially easy on Solaris 10
(using dtrace).
-frank
| |
| Logan Shaw 2006-03-19, 12:02 pm |
| goldfita@signalsguru.net wrote:
> Logan Shaw wrote:
[vbcol=seagreen]
[vbcol=seagreen]
> Thanks. I tried that last trick and got back a lot of output from
> /sys/devices. It's clearly coming from my wireless/usb device
> (driver). I'm not sure what's in /sys, but I get the impression they
> aren't regular files.
That's true. /sys is basically a "magic" filesystem that instead of
storing data lets you read (and write?) various parts of the state of
kernel. It's a filesystem used as an interface into the kernel.
So, when things change in /sys, that doesn't really represent I/O
happening on the disks.
- Logan
|
|
|
|
|