3 ms·

I wish there was a way to see which files were being actively written to sorted by amount of data written. Various times I've seen my disk space rapidly dwindli

by johtso 4y ago

I wish there was a way to see which files were being actively written to sorted by amount of data written. Various times I've seen my disk space rapidly dwindling with no way of know what file was responsible..

astrange 4y ago
Not sure you can do that 100% of the time, since programs can write to unlinked files and I'm not sure those remember what their paths were.
deleted 4y ago
[deleted]
pram 4y ago
Activity monitor shows what’s being written and the accumulative R/W by process. Wouldn’t be too hard to look at lsof and figure it out.
miles 4y ago
FSMonitor[0] is similar to the old FileMon[1] but for macOS. In the default tree view, as new data is written, the entries are highlighted and sort of throb, so it's easy to track what's going on. [0] https://fsmonitor.com/ https://fsmonitor.com/ [1] https://learn.microsoft.com/en-us/sysinternals/downloads/filemon https://learn.microsoft.com/en-us/sysinternals/downloads/fil...
yehaaa 4y ago
Check out rwsnoop, included in macOS. It use Dtrace to trace the read/write syscalls. You need to turn off SIP for Dtrace though afaik.
brigandish 4y ago
Happened to me this morning, something filled up my drive in minutes. I used dust[1] to look for large files while it was happening but knowing what was doing it would've been a big help. [1] https://github.com/bootandy/dust https://github.com/bootandy/dust
krono 4y ago
If you'd rather spend some of your time than your money on this, you can use the built-in fs_usage terminal command and filter its output (e.g. with grep). Works even with SIP enabled, but will then obviously only return information that SIP doesn't cover. More info: man fs_usage Example showing pathname-only events but otherwise unfiltered: sudo fs_usage -ew -f pathname
- Jakob 4y ago
  I used this incantation in the past to get the hottest file paths $ sudo fs_usage -w -t 5 -f filesys | tee fs_usage.log | egrep -o '(/.+?) {3}' | sed -e 's/\/dev\/disk[^ ]+ //' | sort | uniq -c | sort -nr From https://www.jakobstoeck.de/2017/ramdisk-for-faster-applications-under-macos/ https://www.jakobstoeck.de/2017/ramdisk-for-faster-applicati...
  - colonCapitalDee 4y ago
    I'm going to start calling command line commands "incantations"
    - codetrotter 4y ago
      I think you might enjoy this poster then: https://www.reddit.com/r/linux/comments/ifmoua/ive_finally_found_a_good_scan_of_the_unix_magic/ https://www.reddit.com/r/linux/comments/ifmoua/ive_finally_f... Have a look at the writings on the books, the pots, etc, in that picture and I think you will see what I mean ;) You might have to open the picture on a laptop or desktop computer to get a good look at it. On mobile it might be more difficult to see it proper. It’s my favorite poster that I have ever seen. One of these days I will get myself a nice physical copy of it.
      - colonCapitalDee 4y ago
        I have a copy of that poster hanging on my wall!!
deleted 4y ago
[deleted]
jalcazar 4y ago
iotop ?
sva_ 4y ago
On Linux, this can be done using BPF (Berkley Packet Filter). In fact there is a tool in BCC[0] called filetop, which lists reads/writes by process and file[1]. 0. https://github.com/iovisor/bcc https://github.com/iovisor/bcc 1. https://github.com/iovisor/bcc/blob/master/tools/filetop.py https://github.com/iovisor/bcc/blob/master/tools/filetop.py

by johtso 4y ago

astrange 4y ago

Not sure you can do that 100% of the time, since programs can write to unlinked files and I'm not sure those remember what their paths were.

deleted 4y ago

[deleted]

pram 4y ago

Activity monitor shows what’s being written and the accumulative R/W by process. Wouldn’t be too hard to look at lsof and figure it out.

miles 4y ago

FSMonitor[0] is similar to the old FileMon[1] but for macOS. In the default tree view, as new data is written, the entries are highlighted and sort of throb, so it's easy to track what's going on. [0] https://fsmonitor.com/ https://fsmonitor.com/ [1] https://learn.microsoft.com/en-us/sysinternals/downloads/filemon https://learn.microsoft.com/en-us/sysinternals/downloads/fil...

yehaaa 4y ago

Check out rwsnoop, included in macOS. It use Dtrace to trace the read/write syscalls. You need to turn off SIP for Dtrace though afaik.

brigandish 4y ago

Happened to me this morning, something filled up my drive in minutes. I used dust[1] to look for large files while it was happening but knowing what was doing it would've been a big help. [1] https://github.com/bootandy/dust https://github.com/bootandy/dust

krono 4y ago

If you'd rather spend some of your time than your money on this, you can use the built-in fs_usage terminal command and filter its output (e.g. with grep). Works even with SIP enabled, but will then obviously only return information that SIP doesn't cover. More info: man fs_usage Example showing pathname-only events but otherwise unfiltered: sudo fs_usage -ew -f pathname

Jakob 4y ago
I used this incantation in the past to get the hottest file paths $ sudo fs_usage -w -t 5 -f filesys | tee fs_usage.log | egrep -o '(/.+?) {3}' | sed -e 's/\/dev\/disk[^ ]+ //' | sort | uniq -c | sort -nr From https://www.jakobstoeck.de/2017/ramdisk-for-faster-applications-under-macos/ https://www.jakobstoeck.de/2017/ramdisk-for-faster-applicati...
- colonCapitalDee 4y ago
  I'm going to start calling command line commands "incantations"
  - codetrotter 4y ago
    I think you might enjoy this poster then: https://www.reddit.com/r/linux/comments/ifmoua/ive_finally_found_a_good_scan_of_the_unix_magic/ https://www.reddit.com/r/linux/comments/ifmoua/ive_finally_f... Have a look at the writings on the books, the pots, etc, in that picture and I think you will see what I mean ;) You might have to open the picture on a laptop or desktop computer to get a good look at it. On mobile it might be more difficult to see it proper. It’s my favorite poster that I have ever seen. One of these days I will get myself a nice physical copy of it.
    - colonCapitalDee 4y ago
      I have a copy of that poster hanging on my wall!!

deleted 4y ago

[deleted]

jalcazar 4y ago

iotop ?

sva_ 4y ago

On Linux, this can be done using BPF (Berkley Packet Filter). In fact there is a tool in BCC[0] called filetop, which lists reads/writes by process and file[1]. 0. https://github.com/iovisor/bcc https://github.com/iovisor/bcc 1. https://github.com/iovisor/bcc/blob/master/tools/filetop.py https://github.com/iovisor/bcc/blob/master/tools/filetop.py