Master Linux I/O Monitoring: iostat, iotop, and lsof Explained

iostat

iostat monitors disk I/O activity and reports CPU usage; it requires the sysstat package.

# yum -y install sysstat
# iostat
Linux 5.14.0-162.6.1.el9_1.x86_64 (localhost.localdomain) 12/02/22 _x86_64_ (2 CPU)

avg-cpu:  %user   %nice %system %iowait  %steal   %idle
           1.75    0.02    5.84    0.60    0.00   91.79

Device             tps    kB_read/s    kB_wrtn/s    kB_dscd/s    kB_read    kB_wrtn    kB_dscd
 dm-0              73.70      2078.84       358.65         0.00     162919      28107          0
 dm-1               1.26        29.96         0.00         0.00      2348          0          0
 nvme0n1           104.45      2809.71       385.01         0.00    220197      30173          0
 sr0                1.03        40.12         0.00         0.00      3144          0          0

Key sections: avg-cpu shows %user, %nice, %system, %iowait, %idle; Device shows tps, kB_read/s, kB_wrtn/s, etc.

Common options: -c (CPU only), -d (disk only), -k (display in KB), -p DEVICE|ALL, -x (extended), sec (interval seconds).

iotop

iotop provides a top‑like UI for monitoring real‑time disk I/O per process; it must be installed separately.

# yum -y install iotop
# iotop
Total DISK READ :       0.00 B/s | Total DISK WRITE :       0.00 B/s
Actual DISK READ:       0.00 B/s | Actual DISK WRITE:       0.00 B/s
   TID  PRIO  USER     DISK READ DISK WRITE  COMMAND
    1  be/4 root        0.00 B/s    0.00 B/s systemd --switched-root --system --deserialize 28
    2  be/4 root        0.00 B/s    0.00 B/s [kthreadd]
    ... (additional rows omitted for brevity) ...

Important columns include PID/TID, priority, user, read/write rates, and the command line.

Common options: -b (batch mode), -n NUM (number of iterations), -d SEC (delay), -p PID (specific PID), -u USER (filter by user).

lsof

lsof (list open files) enumerates all files opened by processes; it requires root privileges for full information.

# yum -y install lsof
# lsof
COMMAND   PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd     1   0  systemd  root cwd DIR 253,0 235 128 /
systemd     1   0  systemd  root rtd DIR 253,0 235 128 /
systemd     1   0  systemd  root txt REG 253,0 1945080 67508326 /usr/lib/systemd/systemd
... (additional rows omitted for brevity) ...

Key fields: PID – process identifier; USER – process owner; FD – file descriptor; TYPE – file type (DIR, REG, etc.); DEVICE – device name; SIZE – file size; NODE – inode number; NAME – full file name.

Typical usage examples: lsof -c abc (show files opened by processes whose command contains "abc"), lsof -p 1234 (list files for PID 1234), lsof -g gid (show processes belonging to GID), lsof +d /DIR/ (list files opened under a directory).

Source: https://www.cnblogs.com/arthinking/p/14450337.html