Do you want to see the input and output of your hard drive in real time? Do you want to see what applications are reading from and writing to your drive and vice versa?
Dynamic Tracing, or DTrace, is a suite of scripts and frameworks created by Sun Microsystems for troubleshooting. DTrace is supported on Sun’s Solaris platform and has been ported to FreeBSD (upon which OS X is based) and NetBSD. Apple added DTrace support in OS X 10.5 Leopard as part of Xcode’s Instruments development tool.
DTrace is a collection of many different tools and commands that can be run in Terminal to examine just what your computer is doing. One of the DTrace tools is the iosnoop. This is a command that must be run as root, so you’ll need to use sudo to execute it. The command gives you a live readout of your hard drive’s I/O. Each line of output in iosnoop is a system call regarding I/O to your hard drive.
| UID | PID | D | BLOCK | SIZE | COMM | PATHNAME |
|---|---|---|---|---|---|---|
| 501 | 9152 | W | 232493176 | 4096 | PubSubAgent | Database.sqlite3-journal |
| 501 | 8967 | W | 232493176 | 4096 | TextEdit | TextEdit Document.rtf |
| 501 | 8967 | W | 232493184 | 4096 | TextEdit | ??/Autosave Information/.dat2307.020 |
| 501 | 9153 | W | 232493192 | 4096 | PreferenceSyncC | ??/Preferences/com.apple.PreferenceSync.plist |
| 501 | 9153 | R | 45546264 | 8192 | PreferenceSyncC | ??/Preferences/com.apple.sidebarlists.plist |
| 501 | 9153 | R | 45546280 | 8192 | PreferenceSyncC | ??/Preferences/com.apple.sidebarlists.plist |
| 501 | 9153 | R | 45546296 | 8192 | PreferenceSyncC | ??/Preferences/com.apple.sidebarlists.plist |
| 501 | 9153 | R | 25427968 | 4096 | PreferenceSyncC | ??/Preferences/com.apple.java.JavaPreferences.plist |
| 501 | 9153 | W | 1416 | 4096 | PreferenceSyncC | ??/unknown (NULL v_parent) |
| 501 | 9153 | W | 6216 | 4096 | PreferenceSyncC | ??/unknown (NULL v_parent) |
| 501 | 9153 | W | 6544 | 4096 | PreferenceSyncC | ??/unknown (NULL v_parent) |
| 501 | 9153 | W | 6560 | 4096 | PreferenceSyncC | ??/unknown (NULL v_parent) |
(Your output will look different. Our example has been edited so it displays properly.)
In the output above, iosnoop has listed the UID (user ID) who made the call; user 501 (me) has been executing the system I/O calls.
The second column, PID (Process ID), is a unique number provided to each application or routine that the system is performing. The PIDs grow sequentially; as a Process is terminated, it will disappear from the system but it will not give up its number until the system restarts.
The D column references what direction the data was going: R for read events, W for write.
Block refers to the location on the hard drive where the read or write function occurred, and Size is the amount of data in bytes.
COMM is the process name; for each line with a matching PID, COMM will be the same. In the above output, PubSubAgent, TextEdit and PreferenceSyncC were the only processes I captured.
Finally, PATHNAME is the directory path where the data was written to or read from.