FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Debian > Debian User

 
 
LinkBack Thread Tools
 
Old 08-06-2008, 03:36 PM
"Stackpole, Chris"
 
Default Curious about other methods to detect hard drive access

I had an interesting problem (very minor, less of a problem and more of
a curiosity) earlier this morning and while I did solve it, I am curious
as to if there are better methods and how others might have solved it.
So I thought I would ask.

On my top Gnome desktop panel, I have the "System Monitor" displayed. I
was ssh logged into another system when I noticed my system load went
from near flat to about a quarter-to-a-third load. I wasn't doing
anything that should cause that jump, so I expanded the System Monitor
to show all of the stats (cpu, memory, network, swap, load, hard disk).
The Disk usage was at 90%!

I ran iostat to see which of the many disks it was, and saw that the hdc
drive was indeed being used. It had Blk_read/s of ~200. A quick look at
the hdc drive reminded me that it had backups (cron at midnight),
virtual machines (none of which were running), and a Samba share. A
quick look at htop confirmed that a smb process was fluctuating between
15-25%.

"Is someone pulling from my share?"
"Yup! Be done in a minute."

A quick look into the logs (ls -alh /var/log/samba/ only had one file
modified today) showed his connection but not what files he was pulling.
~30 seconds later the file finished and everything returned to normal.
Case closed, right?

The thing that got me thinking was, if this was a process generating
this disk I/O, or someone being malicious in generating this disk I/O, I
would not have known which file was actually being accessed as I only
found out the process. Is that possible? I am sure that Samba can be
configured to log the information, but what about other processes? Is
there a good way to tell what process/file is accessing the disk?

What would you have done differently?

Thanks!
Have Fun!
~S~


--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
 

Thread Tools




All times are GMT. The time now is 06:13 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org