I can't get to my CentOS box for a few days, but was wondering what
explanations folks might offer for a big annoyance: The drive light is
flashing constantly, as if the system is accessing the disk with
alarming frequency. This is a fast Maxtor 40GB which still tests out
solid and without flaws. After a recent update to CentOS 4.4-x86-64,
this behavior started.

What diagnostic tools would you folks suggest?

--
Ed Hurst
----------
return addy is a spam trap
try je hurst at gmail dot com

[ Post a follow-up to this message ]

On 2006-09-09, Ed Hurst <me@privacy.net> wrote:
> I can't get to my CentOS box for a few days, but was wondering what
> explanations folks might offer for a big annoyance: The drive light is
> flashing constantly, as if the system is accessing the disk with
> alarming frequency. This is a fast Maxtor 40GB which still tests out
> solid and without flaws. After a recent update to CentOS 4.4-x86-64,
> this behavior started.
>
> What diagnostic tools would you folks suggest?

How often? Every ten seconds or constantly.
Check in /etc/cron.d
I believe sysstat runs quite often! (but it should
just add a line to the logs - not much more ...)

[ Post a follow-up to this message ]

Spamless wrote:
> On 2006-09-09, Ed Hurst <me@privacy.net> wrote: 
>
> How often? Every ten seconds or constantly.
> Check in /etc/cron.d
> I believe sysstat runs quite often! (but it should
> just add a line to the logs - not much more ...)

Constant, literally. There is less than a second between each flash of
the harddrive indicator light.

--
Ed Hurst
----------
return addy is a spam trap
try je hurst at gmail dot com

[ Post a follow-up to this message ]

Ed Hurst <me@privacy.net> writes:
>Spamless wrote: 
>
>Constant, literally. There is less than a second between each flash of
>the harddrive indicator light.

Messages are logged to syslog with O_SYNC, causing a disk I/O for each line
in /var/log/messages (or wherever /etc/syslog.conf directs the messages).
Frequent disk activity may be due to excessive logging or attempted system
compromise (e.g. failed ssh connection attempts).

sar -d 5 10

will provide 10 samples, 5 seconds apart of disk activity.

Correlating sar(1) data with top(1) output may be indicative
of the process which is issuing the I/O.

scott

[ Post a follow-up to this message ]

Scott Lurndal wrote:

> sar -d 5 10
>
> will provide 10 samples, 5 seconds apart of disk activity.
>
> Correlating sar(1) data with top(1) output may be indicative
> of the process which is issuing the I/O.

Thank you, Scott. I had to download the sysstat package to get the sar
command. The only question I have is what to make of "dev3-0" being the
only thing with any activity.

After digging around I found the updated KDE has an autostart command
which checks too often. When I changed 1000 milliseconds to 10,000 it
calmed down. Now I get a brief flash about every three seconds. I'm
guessing that's closer to normal for Linux.

--
Ed Hurst
----------
return addy is a spam trap
try je hurst at gmail dot com

[ Post a follow-up to this message ]

Ed Hurst <me@privacy.net> writes:
>Scott Lurndal wrote:
> 
>
>Thank you, Scott. I had to download the sysstat package to get the sar
>command. The only question I have is what to make of "dev3-0" being the
>only thing with any activity.

dev3-0 is the device identified by major number 3, minor number 0.

$ ls -l /dev | grep "3,"
brw-------  1 root  disk     3,   0 Sep  5 11:24 hda

In my case, hda is a read-only optical device, in yours, probably
your primary hard drive.

scott

[ Post a follow-up to this message ]

Scott Lurndal wrote:

> dev3-0 is the device identified by major number 3, minor number 0.
>
> $ ls -l /dev | grep "3,"
> brw-------  1 root  disk     3,   0 Sep  5 11:24 hda
>
> In my case, hda is a read-only optical device, in yours, probably
> your primary hard drive.

Quite correct. Again, thank you very much for the lesson. That command
was all the hint I needed to make sense of the whole major/minor device
issue.

--
Ed Hurst
----------
return addy is a spam trap
try je hurst at gmail dot com

[ Post a follow-up to this message ]