5.2. Disk

The following sections showcase scripts that monitor disk and I/O activity.

5.2.1. Summarizing Disk Read/Write Traffic

This section describes how to identify which processes are performing the heaviest disk reads/writes to the system.
#!/usr/bin/env stap 
# Copyright (C) 2007 Oracle Corp.
# Get the status of reading/writing disk every 5 seconds,
# output top ten entries 
# This is free software,GNU General Public License (GPL);
# either version 2, or (at your option) any later version.
# Usage:
#  ./disktop.stp

global io_stat,device
global read_bytes,write_bytes

probe vfs.read.return {
  if (returnval()>0) {
    if (devname!="N/A") {/*skip read from cache*/
      io_stat[pid(),execname(),uid(),ppid(),"R"] += returnval()
      device[pid(),execname(),uid(),ppid(),"R"] = devname
      read_bytes += returnval()

probe vfs.write.return {
  if (returnval()>0) {
    if (devname!="N/A") { /*skip update cache*/
      io_stat[pid(),execname(),uid(),ppid(),"W"] += returnval()
      device[pid(),execname(),uid(),ppid(),"W"] = devname
      write_bytes += returnval()

probe timer.ms(5000) {
  /* skip non-read/write disk */
  if (read_bytes+write_bytes) {

    printf("\n%-25s, %-8s%4dKb/sec, %-7s%6dKb, %-7s%6dKb\n\n",
           "Average:", ((read_bytes+write_bytes)/1024)/5,

    /* print header */
    printf("%8s %8s %8s %25s %8s %4s %12s\n",
  /* print top ten I/O */
  foreach ([process,cmd,userid,parent,action] in io_stat- limit 10)
    printf("%8d %8d %8d %25s %8s %4s %12d\n",

  /* clear data */
  delete io_stat
  delete device
  read_bytes = 0
  write_bytes = 0  

probe end{
  delete io_stat
  delete device
  delete read_bytes
  delete write_bytes
disktop.stp outputs the top ten processes responsible for the heaviest reads/writes to disk. Example 5.6, “disktop.stp Sample Output” displays a sample output for this script, and includes the following data per listed process:
  • UID — user ID. A user ID of 0 refers to the root user.
  • PID — the ID of the listed process.
  • PPID — the process ID of the listed process's parent process.
  • CMD — the name of the listed process.
  • DEVICE — which storage device the listed process is reading from or writing to.
  • T — the type of action performed by the listed process; W refers to write, while R refers to read.
  • BYTES — the amount of data read to or written from disk.
The time and date in the output of disktop.stp is returned by the functions ctime() and gettimeofday_s(). ctime() derives calendar time in terms of seconds passed since the Unix epoch (January 1, 1970). gettimeofday_s() counts the actual number of seconds since Unix epoch, which gives a fairly accurate human-readable timestamp for the output.
In this script, the $return is a local variable that stores the actual number of bytes each process reads or writes from the virtual file system. $return can only be used in return probes (for example, vfs.read.return and vfs.read.return).

Example 5.6. disktop.stp Sample Output

Mon Sep 29 03:38:28 2008 , Average:  19Kb/sec, Read: 7Kb, Write: 89Kb

UID      PID     PPID                       CMD   DEVICE    T    BYTES
0    26319    26294                   firefox     sda5    W        90229
0     2758     2757           pam_timestamp_c     sda5    R         8064
0     2885        1                     cupsd     sda5    W         1678

Mon Sep 29 03:38:38 2008 , Average:   1Kb/sec, Read: 7Kb, Write: 1Kb

UID      PID     PPID                       CMD   DEVICE    T    BYTES
0     2758     2757           pam_timestamp_c     sda5    R         8064
0     2885        1                     cupsd     sda5    W         1678