1 .TH iosnoop 1m "$Date:: 2007-08-05 #$" "USER COMMANDS"
3 iosnoop \- snoop I/O events as they occur. Uses DTrace.
6 [\-a|\-A|\-Deghinostv] [\-d device] [\-f filename] [\-m mount_point]
9 iosnoop prints I/O events as they happen, with useful details such
10 as UID, PID, block number, size, filename, etc.
12 This is useful to determine the process responsible for
13 using the disks, as well as details on what activity the process
14 is requesting. Behaviour such as random or sequential I/O can
15 be observed by reading the block numbers.
17 Since this uses DTrace, only the root user or users with the
18 dtrace_kernel privilege can run this command.
22 stable - needs the io provider.
29 dump all data, space delimited
32 print time delta, us (elapsed)
41 print major and minor numbers
44 print disk delta time, us
50 print completion time, us
53 print completion time, string
56 instance name to snoop (eg, dad0)
59 full pathname of file to snoop
62 mountpoint for filesystem to snoop
72 Default output, print I/O activity as it occurs,
77 Print human readable timestamps,
83 Print major and minor numbers,
89 Snoop events on the root filesystem only,
106 command name for the process
109 argument listing for the process
112 size of the operation, bytes
115 disk block for the operation (location. relative to this filesystem.
116 more useful with the -n option to print major and minor numbers)
119 timestamp for the disk request, us
122 timestamp for the disk completion, us
125 elapsed time from request to completion, us (this is the elapsed
126 time from the disk request (strategy) to the disk completion (iodone))
129 time for disk to complete request, us (this is the time for the
130 disk to complete that event since it's last event (time between iodones),
131 or, the time to the strategy if the disk had been idle)
134 timestamp for the disk completion, string
140 device instance number
143 direction, Read or Write
149 filename (basename) for I/O operation
152 When filtering on PID or process name, be aware that poor disk event
153 times may be due to events that have been filtered away, for example
154 another process that may be seeking the disk heads elsewhere.
157 See the DTraceToolkit for further documentation under the
158 Docs directory. The DTraceToolkit docs may include full worked
159 examples with verbose descriptions explaining the output.
161 iosnoop will run forever until Ctrl\-C is hit.
166 iotop(1M), dtrace(1M)