iosnoop - snoop I/O events as they occur. Uses DTrace.

iosnoop [-a|-A|-Deghinostv] [-d device] [-f filename] [-m mount_point] [-n name] [-p PID] outputs I/O events as they happen, with useful details such as UID, PID, block number, size, filename, etc.

Useful to determine the process responsible for using the disks, as well as details on what activity the process is requesting. Behaviour such as random or sequential I/O can be observed by reading the block numbers. Uses DTrace, only users with root privileges can run this command.

-f filename full pathname of file to snoop
-m mount_point mountpoint for filesystem to snoop
-d device instance name to snoop (eg, dad0)
Output controls
-a all
-A all , space delimited
-D time delta, us (elapsed)
-e device name
-i device instance
-N major and minor numbers
-o disk delta time, us
-s start time, us
-t completion time, us
-v completion time, string
-n name process name
-p PID process ID

Examples

Default output, print I/O activity as it occurs,
sudo iosnoop
Print human readable timestamps,
sudo iosnoop -v
STRTIME UID PID D BLOCK SIZE COMM PATHNAME
2012 Aug 4 11:31:04 503 2312 W 5507984 4096 thunderbird ??/dgerman/popstate.dat
2012 Aug 4 11:31:04 503 2312 W 5507984 4096 thunderbird ??/dgerman/popstate.dat
Print major and minor numbers,
              sudo  iosnoop -N
MAJ MIN   UID   PID D    BLOCK   SIZE       COMM PATHNAME
 14   6   503  1287 R  5540248   4096   Terminal ??/com.apple.Terminal.savedState/data.data
 14   6   503  1287 R  5540296   8192   Terminal ??/com.apple.Terminal.savedState/data.data
 14   6   503  1287 R  5540304   4096   Terminal ??/com.apple.Terminal.savedState/data.data
 14   6   503  1287 W  5540248  40960   Terminal ??/com.apple.Terminal.savedState/data.data
 14   6   503  1287 W  5508240   4096   Terminal ??/com.apple.Terminal.savedState/windows.plist
 14   2   503 13308 W 49549800   4096        sed ??/tmp/dfdf_1
 14   2   503 13316 W 49549808   4096        sed ??/tmp/dfdf_0
 14   6   503  2312 W  5508248   4096 thunderbird ??/dgerman/popstate.dat
 14   6   503  2312 W  5508248   4096 thunderbird ??/dgerman/popstate.dat
 14   2   503 13326 W 49549800   4096        sed ??/tmp/dfdf_1
 14   2   503 13388 W 49549808   4096        sed ??/tmp/dfdf_0
 14   6   503  2312 W  5508528  20480 thunderbird ??/dgermanx/popstate.dat
 14   6   503  2312 W  5508528  20480 thunderbird ??/dgermanx/popstate.dat
 14   2   503 13398 W 49549800   4096        sed ??/tmp/dfdf_1
 14   2   503 13406 W 49549808   4096        sed ??/tmp/dfdf_0
 14   2     0     1 W 49759184   4096    launchd ??/asl/2012.08.04.U0.G80.asl
 14   2     0     1 W 49760040   4096    launchd ??/asl/2012.08.04.U0.G80.asl
 14   2     0     1 W 49760096   4096    launchd ??/asl/2012.08.04.U0.G80.asl
 14   2     0     1 W 49760752   4096    launchd ??/asl/2012.08.04.G80.asl
 14   2     0     1 W 49775752   4096    launchd ??/asl/2012.08.04.G80.asl
 14   2     0     1 W 49760088   4096    launchd ??/log/07_debug.log
 14   2     0     1 W 49551632   4096    launchd ??/log/06_info.log
 14   2     0     1 W 30298120   4096    launchd ??/asl/StoreData
 14   6     0     1 W    28136   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
 14   6     0     1 W  1508952   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
 14   6     0     1 W  1650920   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
 14   2     0     1 W 49759128   4096    launchd ??/log/system.log
 14   2     0     1 W 49549712   4096    launchd ??/log/secure.log
 14   2     0     1 W 49551424   4096    launchd ??/log/05_notice.log
 14   2     0     1 W 44825056   4096    launchd ??/log/04_warn.log
 14   2     0     1 W 59653408   4096    launchd ??/log/03_err.log

 sudo iosnoop -v -o -D|grep -v dfdf
STRTIME              DELTA      DTIME        UID   PID D    BLOCK   SIZE       COMM PATHNAME
2012 Aug  4 11:40:16 1098       1114         503  1287 R  5540880   4096   Terminal ??/com.apple.Terminal.savedState/data.data
2012 Aug  4 11:40:16 155        163          503  1287 W  5540880   4096   Terminal ??/com.apple.Terminal.savedState/data.data
2012 Aug  4 11:40:16 1842       1715         503  1287 W  5541272 184320   Terminal ??/com.apple.Terminal.savedState/data.data
2012 Aug  4 11:40:16 1846       264          503  1287 W  5541632   4096   Terminal ??/com.apple.Terminal.savedState/windows.plist
2012 Aug  4 11:40:23 260        276            0     1 W 49759184   4096    launchd ??/asl/2012.08.04.U0.G80.asl
2012 Aug  4 11:40:23 263        64             0     1 W 49760096   4096    launchd ??/asl/2012.08.04.U0.G80.asl
2012 Aug  4 11:40:23 251        263            0     1 W 49759200   4096    launchd ??/log/system.log
2012 Aug  4 11:40:23 238        50             0     1 W 49549712   4096    launchd ??/log/secure.log
2012 Aug  4 11:40:23 282        83             0     1 W 49551432   4096    launchd ??/log/05_notice.log
2012 Aug  4 11:40:23 448        193            0     1 W 44825064   4096    launchd ??/log/04_warn.log
2012 Aug  4 11:40:23 508        84             0     1 W 59653408   4096    launchd ??/log/03_err.log
2012 Aug  4 11:40:23 274        289            0     1 W 49760752   4096    launchd ??/asl/2012.08.04.G80.asl
2012 Aug  4 11:40:23 280        64             0     1 W 49775752   4096    launchd ??/asl/2012.08.04.G80.asl
2012 Aug  4 11:40:23 277        284            0     1 W 49760104   4096    launchd ??/log/07_debug.log
2012 Aug  4 11:40:23 358        107            0     1 W 49551640   4096    launchd ??/log/06_info.log
2012 Aug  4 11:40:23 424        96             0     1 W 30298120   4096    launchd ??/asl/StoreData
2012 Aug  4 11:40:23 574        594            0     1 W    28136   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
…
2012 Aug  4 11:40:23 2388       123            0     1 W  6336136   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
2012 Aug  4 11:40:27 24803      24823        503  2312 R 16882032  98304 thunderbird ??/MacOS/XUL
2012 Aug  4 11:40:27 15001      15017        503  2312 R 16865560 245760 thunderbird ??/MacOS/XUL
2012 Aug  4 11:40:48 18499      18515        503  1287 R  5540248   4096   Terminal ??/com.apple.Terminal.savedState/data.data
…
2012 Aug  4 11:40:48 7063       186          503  1287 W  5541272   8192   Terminal ??/com.apple.Terminal.savedState/data.data
2012 Aug  4 11:40:48 6934       113          503  1287 W  5541288   4096   Terminal ??/com.apple.Terminal.savedState/windows.plist
2012 Aug  4 11:40:53 486        506            0     1 W    28136   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
2012 Aug  4 11:40:53 535        85             0     1 W   138776   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
2012 Aug  4 11:40:53 574        72             0     1 W   159376   4096    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
2012 Aug  4 11:40:53 626        82             0     1 W  1491208   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
2012 Aug  4 11:40:54 249        269            0     1 W     1520   4096    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
2012 Aug  4 11:40:54 320        107            0     1 W  6133800   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
2012 Aug  4 11:40:55 252        272          503  2312 W  5541296   4096 thunderbird ??/dgerman/popstate.dat
2012 Aug  4 11:40:55 919        930          503  2312 W  5541296   4096 thunderbird ??/dgerman/popstate.dat

2012 Aug  4 11:41:10 9565       9580         503  2312 R  5082624   4096 thunderbird ??/thunderBird/zhicom.msf
2012 Aug  4 11:41:10 25711      25731        503  2312 R 58562696   4096 thunderbird ??/Paddling.sbd/PhillyRegatta.msf
2012 Aug  4 11:41:10 279        293          503  2312 R 58562704   4096 thunderbird ??/Paddling.sbd/PhillyRegatta.msf
2012 Aug  4 11:41:10 313        89           503  2312 R 58562712   8192 thunderbird ??/Paddling.sbd/PhillyRegatta.msf
2012 Aug  4 11:41:10 234        248          503  2312 R 58562728  16384 thunderbird ??/Paddling.sbd/PhillyRegatta.msf
2012 Aug  4 11:41:10 324        334          503  2312 R 58562760  32768 thunderbird ??/Paddling.sbd/PhillyRegatta.msf
2012 Aug  4 11:41:10 476        439          503  2312 R 58562824  45056 thunderbird ??/Paddling.sbd/PhillyRegatta.msf
2012 Aug  4 11:41:10 355        375          503  2312 W  5541304  20480 thunderbird ??/dgermanx/popstate.dat
2012 Aug  4 11:41:10 491        504          503  2312 W  5541304  20480 thunderbird ??/dgermanx/popstate.dat
2012 Aug  4 11:41:18 21910      21930        222    66 R 50260528   4096   netbiosd ??/A/SMBClient/..namedfork/rsrc
2012 Aug  4 11:41:18 471        487          222    66 R 50260536  28672   netbiosd ??/A/SMBClient/..namedfork/rsrc
2012 Aug  4 11:41:18 339        354          222    66 R 50260592  24576   netbiosd ??/A/SMBClient/..namedfork/rsrc
2012 Aug  4 11:41:18 11789      11799        222    66 R 49773952   4096   netbiosd ??/SystemConfiguration/com.apple.smb.server.plist
2012 Aug  4 11:41:18 13890      13904        222    66 R 37529224 344064   netbiosd ??/dyld/dyld_shared_cache_x86_64
2012 Aug  4 11:41:18 1576       1590         222    66 R 37529896 180224   netbiosd ??/dyld/dyld_shared_cache_x86_64
2012 Aug  4 11:41:18 9778       9793         222    66 R 27079896 339968   netbiosd ??/dyld/dyld_shared_cache_x86_64
2012 Aug  4 11:41:18 15060      15071        222    66 R 37583768  40960   netbiosd ??/dyld/dyld_shared_cache_x86_64
2012 Aug  4 11:41:18 14787      14797        222    66 R 24268168 208896   netbiosd ??/dyld/dyld_shared_cache_x86_64
2012 Aug  4 11:41:18 9132       9147           0 17263 R 10246104   4096    launchd ??/sbin/gssd/..namedfork/rsrc
2012 Aug  4 11:41:18 461        473            0 17263 R 10246112  24576    launchd ??/sbin/gssd/..namedfork/rsrc
2012 Aug  4 11:41:18 339        353            0 17263 R 10246160  28672       gssd ??/sbin/gssd/..namedfork/rsrc
2012 Aug  4 11:41:18 9050       9065          65    12 R 50248768  16384 mDNSResponder ??/sbin/mDNSResponder/..namedfork/rsrc
2012 Aug  4 11:41:18 160        171            0 17263 R  9573248   4096       gssd ??/MacOS/heimdalodpac/..namedfork/rsrc
2012 Aug  4 11:41:18 14309      14323          0 17263 R 26899976   4096       gssd ??/etc/hosts
2012 Aug  4 11:41:18 7386       7403           0 17263 R  9573256   4096       gssd ??/MacOS/heimdalodpac/..namedfork/rsrc
2012 Aug  4 11:41:18 201        214            0 17263 R  9573240   4096       gssd ??/MacOS/heimdalodpac/..namedfork/rsrc
2012 Aug  4 11:41:18 9230       9242           0 17263 R 42517000   4096       gssd ??/MacOS/Reachability/..namedfork/rsrc
2012 Aug  4 11:41:18 277        290            0 17263 R 42516984   4096       gssd ??/MacOS/Reachability/..namedfork/rsrc
2012 Aug  4 11:41:18 238        254            0 17263 R 42516992   4096       gssd ??/MacOS/Reachability/..namedfork/rsrc
2012 Aug  4 11:41:18 176        190            0 17263 R 42517024   4096       gssd ??/MacOS/SCKerberosConfig/..namedfork/rsrc
2012 Aug  4 11:41:18 187        198            0 17263 R 42517008   4096       gssd ??/MacOS/SCKerberosConfig/..namedfork/rsrc
2012 Aug  4 11:41:18 205        217            0 17263 R 42517016   4096       gssd ??/MacOS/SCKerberosConfig/..namedfork/rsrc
2012 Aug  4 11:41:18 275        301            0 17263 R 10246232   4096       gssd ??/sbin/gssd/..namedfork/rsrc
2012 Aug  4 11:41:20 200        216          503  1287 W  5500136   4096   Terminal ??/com.apple.Terminal.savedState/window_2.data
2012 Aug  4 11:41:20 1039       1046         503  1287 R  5541280   4096   Terminal ??/com.apple.Terminal.savedState/data.data
2012 Aug  4 11:41:20 714        721          503  1287 W  5541280   4096   Terminal ??/com.apple.Terminal.savedState/data.data
2012 Aug  4 11:41:20 768        75           503  1287 W  5541344   4096   Terminal ??/com.apple.Terminal.savedState/data.data
2012 Aug  4 11:41:20 654        49           503  1287 W  5541352   4096   Terminal ??/com.apple.Terminal.savedState/windows.plist
2012 Aug  4 11:41:24 622        642            0     1 W    28136   8192    launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>

Snoop events on the root filesystem only,
sudo iosnoop -m /

FIELDS

UID User ID
PID Process ID
PPID Parent Process ID
COMM command name for the process
ARGS argument listing for the process
SIZE size of the operation, bytes
BLOCK disk block for the operation (location. relative to this filesystem. more useful with the -n option to print major and minor numbers)
STIME timestamp for the disk request, us
TIME timestamp for the disk completion, us
DELTA elapsed time from request to completion, us (this is the elapsed time from the disk request (strategy) to the disk completion (iodone))
DTIME time for disk to complete request, us (this is the time for the disk to complete that event since it's last event (time between iodones), or, the time to the strategy if the disk had been idle)
STRTIMEtimestamp for the disk completion, string
DEVICEdevice name
INS device instance number
D direction, Read or Write
MOUNT mount point
FILE filename (basename) for I/O operation
NOTES When filtering on PID or process name, be aware that poor disk event times may be due to events that have been filtered away, for example another process that may be seeking the disk heads elsewhere.