On 23/02/07, Tzahi Fadida <[EMAIL PROTECTED]> wrote:
It may not be accurate from various reasons, namely, the I/O queue CFQ,etc... which delays certain writes reads depending on the position of the head of the disk. In addition, dirtied buffers which are written to disk in unknown future time. However, for the purposes of what most people needs this, it should do. For example, most people are interested to know, what process is generating most/a lot of/not at all I/O requests and they will be willing to take an estimate. For that it will suffice. Unless, of course, there is a facility in linux that does that, that i am unaware of.
In addition - if I understand the theory then most inaccuracies will happen because of multiple processes accessing the same files and/or re-writing existing blocks in files. I'd expect most usage patterns to be outside this criteria - you don't get many situations where multiple processes write to the same file and overwrite each other's write requests in memory before they reach the disk, do you? getrusage(2) seems to return total IO done by processes, but it's only available for the calling process or terminated children. I suppose this is what the time(1) commands use. Assuming the above (i.e. files are mostly not written concurrently by multiple processes), maybe you can try to track write(2) system calls. Mulli's old syscalltack (http://syscalltrack.sourceforge.net/) should have been able to do this for you if it was still relevant for current kernels (is it?) "inotifywatch -m -r" could report changes to files and directories. It doesn't report WHO changed the file but it might give you a pointer in the right direction. It looks like the most re-occurring questions on Linux forums so it's worth to keep digging. --Amos
