manpagez: man pages & more
man iosnoop(1)
Home | html | info | man
iosnoop(1)                      USER COMMANDS                     iosnoop(1)


       iosnoop - snoop I/O events as they occur. Uses DTrace.


       iosnoop  [-a|-A|-Deghinostv] [-d device] [-f filename] [-m mount_point]
       [-n name] [-p PID]


       iosnoop prints I/O events as they happen, with useful details  such  as
       UID, PID, block number, size, filename, etc.

       This  is  useful  to  determine  the  process responsible for using the
       disks, as well as details on what activity the process  is  requesting.
       Behaviour  such  as random or sequential I/O can be observed by reading
       the block numbers.

       Since this uses DTrace, only users with root privileges  can  run  this


       -a     print all data

       -A     dump all data, space delimited

       -D     print time delta, us (elapsed)

       -e     print device name

       -i     print device instance

       -n     print major and minor numbers

       -o     print disk delta time, us

       -s     print start time, us

       -t     print completion time, us

       -v     print completion time, string

       -d device
              instance name to snoop (eg, dad0)

       -f filename
              full pathname of file to snoop

       -m mount_point
              mountpoint for filesystem to snoop

       -n name
              process name

       -p PID process ID


       Default output, print I/O activity as it occurs,
              # iosnoop

       Print human readable timestamps,
              # iosnoop -v

       Print major and minor numbers,
              # iosnoop -n

       Snoop events on the root filesystem only,
              # iosnoop -m /


       UID    User ID

       PID    Process ID

       PPID   Parent Process ID

       COMM   command name for the process

       ARGS   argument listing for the process

       SIZE   size of the operation, bytes

       BLOCK  disk  block  for  the  operation  (location.  relative  to  this
              filesystem.  more useful with the -n option to print  major  and
              minor numbers)

       STIME  timestamp for the disk request, us

       TIME   timestamp for the disk completion, us

       DELTA  elapsed time from request to completion, us (this is the elapsed
              time from the disk request (strategy)  to  the  disk  completion

       DTIME  time  for disk to complete request, us (this is the time for the
              disk to complete that event since it's last event (time  between
              iodones),  or,  the  time  to  the strategy if the disk had been

              timestamp for the disk completion, string

       DEVICE device name

       INS    device instance number

       D      direction, Read or Write

       MOUNT  mount point

       FILE   filename (basename) for I/O operation


       When filtering on PID or process name, be aware that  poor  disk  event
       times  may  be  due to events that have been filtered away, for example
       another process that may be seeking the disk heads elsewhere.


       See the DTraceToolkit for further documentation under the  Docs  direc-
       tory. The DTraceToolkit docs may include full worked examples with ver-
       bose descriptions explaining the output.


       iosnoop will run forever until Ctrl-C is hit.


       Brendan Gregg [Sydney, Australia]


       iotop(1M), dtrace(1M)

version 1.50                     Jul 25, 2005                      iosnoop(1)

Mac OS X 10.6 - Generated Thu Sep 17 20:07:55 CDT 2009
© 2000-2023
Individual documents may contain additional copyright information.