iosnoop(1m) USER COMMANDS iosnoop(1m)

NAME
       iosnoop - snoop I/O events as they occur. Uses DTrace.

SYNOPSIS
       iioossnnoooopp  [-a|-A|-Deghinostv] [-d device] [-f filename] [-m mountpoint]
       [-n name] [-p PID]

DESCRIPTION
       iosnoop prints I/O events as they happen, with useful details  such  as
       UID, PID, block number, size, filename, etc.

       This  is  useful  to  determine  the  process responsible for using the
       disks, as well as details on what activity the process  is  requesting.
       Behaviour  such  as random or sequential I/O can be observed by reading
       the block numbers.

       Since  this  uses  DTrace,  only  the  root  user  or  users  with  the
       dtracekernel privilege can run this command.

OOPPTTIIOONNSS
       -a     print all data

       -A     dump all data, space delimited

       -D     print time delta, us (elapsed)

       -e     print device name

       -i     print device instance

       -n     print major and minor numbers

       -o     print disk delta time, us

       -s     print start time, us

       -t     print completion time, us

       -v     print completion time, string

       -d device
              instance name to snoop (eg, dad0)

       -f filename
              full pathname of file to snoop

       -m mountpoint
              mountpoint for filesystem to snoop

       -n name
              process name

       -p PID process ID


EEXXAAMMPPLLEESS
       Default output, print I/O activity as it occurs,
              # iioossnnoooopp


       Print human readable timestamps,
              # iioossnnoooopp -v


       Print major and minor numbers,
              # iioossnnoooopp -n


       Snoop events on the root filesystem only,
              # iioossnnoooopp -m /


FFIIEELLDDSS
       UID    User ID

       PID    Process ID

       PPID   Parent Process ID

       COMM   command name for the process

       ARGS   argument listing for the process

       SIZE   size of the operation, bytes

       BLOCK  disk  block  for  the  operation  (location.  relative  to  this
              filesystem.  more useful with the -n option to print  major  and
              minor numbers)

       STIME  timestamp for the disk request, us

       TIME   timestamp for the disk completion, us

       DELTA  elapsed time from request to completion, us (this is the elapsed
              time from the disk request (strategy)  to  the  disk  completion
              (iodone))

       DTIME  time  for disk to complete request, us (this is the time for the
              disk to complete that event since it's last event (time  between
              iodones),  or,  the  time  to  the strategy if the disk had been
              idle)

       STRTIME
              timestamp for the disk completion, string

       DEVICE device name

       INS    device instance number

       D      direction, Read or Write

       MOUNT  mount point

       FILE   filename (basename) for I/O operation


NNOOTTEESS
       When filtering on PID or process name, be aware that  poor  disk  event
       times  may  be  due to events that have been filtered away, for example
       another process that may be seeking the disk heads elsewhere.


DDOOCCUUMMEENNTTAATTIIOONN
       See the DTraceToolkit for further documentation under the  Docs  direc-
       tory. The DTraceToolkit docs may include full worked examples with ver-
       bose descriptions explaining the output.

EEXXIITT
       iosnoop will run forever until Ctrl-C is hit.

AUTHOR       Brendan Gregg [Sydney, Australia]

SEE ALSO
       iotop(1M), dtrace(1M)




version 1.50                     Jul 25, 2005                      iosnoop(1m)