iosnoop

Snoop I/O events as they occur. Uses DTrace.

Syntax
      iosnoop [-a|-A|-Deghinostv] [-d device] [-f filename] [-m mount_point]
         [-n name] [-p PID]

Key
   -a     print all data

   -A     dump all data, space delimited

   -D     print time delta, us (elapsed)

   -e     print device name

   -i     print device instance

   -N     print major and minor numbers

   -o     print disk delta time, us

   -s     print start time, us

   -t     print completion time, us

   -v     print completion time, string

   -d device
          instance name to snoop (eg, dad0)

   -f filename
          full pathname of file to snoop

   -m mount_point
          mountpoint for filesystem to snoop

   -n name
          process name

   -p PID process ID

iosnoop prints I/O events as they happen, with useful details such as UID, PID, block number, size, filename, etc. This is useful to determine the process responsible for using the disks, as well as details on what activity the process is requesting. Behaviour such as random or sequential I/O can be observed by reading the block numbers.

Since this uses DTrace, only users with root privileges can run this command.

iosnoop will run forever until Ctrl-C is hit.

Examples

Default output, print I/O activity as they are executed:
$ iosnoop

Print human readable timestamps:
$ iosnoop -v

Print major and minor numbers:
$ iosnoop -N

Snoop events on the root filesystem only:
$ iosnoop -m /

Fields

  UID    User ID.
  PID    Process ID.
  PPID   Parent Process ID.
  COMM   command name for the process.
  ARGS   argument listing for the process.
  SIZE   size of the operation, bytes.

  BLOCK  disk  block  for  the  operation  (location.  relative  to  this
         filesystem.  more useful with the -N option to print  major  and
         minor numbers.)

  STIME  timestamp for the disk request, us.
  TIME   timestamp for the disk completion, us.

  DELTA  elapsed time from request to completion, us (this is the elapsed
         time from the disk request (strategy)  to  the  disk  completion (iodone))

  DTIME  time  for disk to complete request, us (this is the time for the
         disk to complete that event since it's last event (time  between iodones)
         or,  the  time  to  the strategy if the disk had been idle)

  STRTIME  timestamp for the disk completion, string.
  DEVICE device name.
  INS    device instance number.
  D      direction, Read or Write.
  MOUNT  mount point.
  FILE   filename (basename) for I/O operation

"Physical fitness is not only one of the most important keys to a healthy body, it is the basis of dynamic and creative intellectual activity" ~ John Fitzgerald Kennedy

Related macOS commands:

dtrace - generic front-end to the DTrace facility
opensnoop - Snoop file opens as they occur
Top 10 DTrace scripts - Brandan Gregg (author of the dtrace book)