>

How do I see which process is hammering the disk on Linux?

A terminal walkthrough to find the process behind constant disk I/O on Linux, confirm it is a sustained hog, and verify the disk has calmed down.

LinuxProcessesiotopmonitoringperformancediskpidstatMedium risk
Run sudo iotop -o -a — the -o flag hides every idle process, so you see only the processes reading and writing your disk right now, together with their PIDs.

What this covers

Constant disk grinding, a machine that feels slow even though the CPU is idle, and a load average that never comes down usually mean one process is saturating your disk. This guide shows you how to name that process from the terminal, confirm it really is the culprit, and check that the disk is quiet again once you have dealt with it.

Symptom

?The disk activity light never stops, opening a file or running a simple ls takes seconds, top shows a high wa (I/O wait) percentage while user CPU stays low, and dmesg or the journal may show tasks blocked on I/O.

Find the process that is reading and writing right now

iotop is top for disk I/O: it lists processes with their read and write throughput, and the -o flag hides everything that is idle so only live I/O shows up. Note the PID in the first column of the top row and what the process actually is — a database, a backup, a sync client or a rogue service. The -a flag switches from a rolling rate to accumulated totals, which helps when the offender damages the disk in short bursts. If the list stays empty, the pressure is coming from kernel writeback or a flush rather than a normal user process.

LinuxFind Disk I/O Per Process with iotopMedium riskStep 1

Use iotop to see exactly which process is reading and writing your disk in real time.

Command
$ sudo iotop -o -a
Full explanation & undo →

Confirm the suspect is a sustained hog, not a blip

pidstat with -d reports per-process I/O, and adding -u -r shows CPU and memory at the same time, so you can tell whether the process really is disk-bound. Replace 1234 in the command with the PID you noted in iotop's first column; the trailing numbers are the sampling interval in seconds and how many samples to take. If the kB_rd/s and kB_wr/s columns stay high on every sample, you have your culprit; if they sit near zero, go back to the iotop list and check the next process.

LinuxProfile a Single Process with pidstatLow riskStep 2

pidstat prints time-series CPU, memory, and I/O statistics for one PID (or all tasks), ideal for capturing a process's behavior over minutes.

Command
$ pidstat -u -r -d -p 1234 2 5
Full explanation & undo →

Verify the disk has calmed down

Once you have stopped, restarted or rescheduled the process, run iostat -x again and watch %util and await for the device that was busy. %util should fall to a low single-digit percentage and the request queues should empty out. If it is still pinned near 100%, something else is still saturating the device — another process, a RAID rebuild, or a failing disk — so go back to iotop and repeat the search.

LinuxAnalyze Disk I/O with iostat -xLow riskStep 3

iostat -x prints extended per-device statistics — r/s, w/s, await, and %util — refreshed on an interval so you can watch saturation.

Command
$ iostat -x 2 5
Full explanation & undo →
!iotop needs root to see other users' processes and installs from your package manager. Do not kill a process blindly: a database, backup job, container runtime or log shipper doing heavy I/O is often doing its job. Confirm what the process is first, and prefer systemctl or the application's own throttling options over kill -9.

How to confirm it worked

After you stop, restart or reschedule the offending process, iostat -x should show %util back in the low single digits and await close to the normal value for your device; a fresh iotop -o should show nothing but occasional short bursts.

Sources

  • iotop(8) — Debian manpage
    Debian · community · 2026-09-17
    Evidence: Debian manpage for iotop documents -o (only show processes actually doing I/O) and -a (accumulated I/O) options
  • iotop(8) — Arch Linux manual
    Arch Linux · community · 2026-09-17
    Evidence: Arch manual describes iotop's --only (-o) option to show only processes or threads actually doing I/O
  • pidstat(1) - Report statistics for Linux tasks
    Ubuntu Manpages · technical · 2026-09-17
    Evidence: pidstat reports statistics for Linux tasks (processes): -u CPU usage, -r memory, -d I/O, -p selects a task, with interval and count arguments.
  • iostat(1) - Report CPU statistics and I/O statistics for devices
    Ubuntu Manpages · technical · 2026-09-17
    Evidence: -x shows extended statistics; interval and count parameters report repeatedly; %util is the percentage of elapsed time during which the device was busy.

Last verified: 2026-09-22

Related guides

Why is my Linux system slow with high I/O wait?
LinuxProblem fix

Diagnose high I/O wait on Linux: find the saturated disk and the process causing it, then lower its I/O priority so the system responds again.

Medium risk4 steps
Check open ports on Linux
LinuxScenario

A practical checklist for finding which ports are open on a Linux machine or across your network, from local sockets to a full nmap scan.

Medium risk4 steps
Linux high CPU usage: find the culprit and take back your machine
LinuxProblem fix

A terminal-first workflow to diagnose high CPU usage on Linux, identify the responsible process or service, and fix it without losing your work.

Medium risk7 steps