Master Linux I/O Monitoring: iostat, iotop, and lsof Explained

iostat

The iostat tool monitors disk activity and reports both I/O statistics and CPU usage. It requires the sysstat package.

# yum -y install sysstat
# iostat

Typical output includes an avg-cpu section (user, nice, system, iowait, idle percentages) and a Device section (tps, kB_read/s, kB_wrtn/s, etc.). Common fields: %user: CPU time spent in user space %nice: CPU time spent on nice‑adjusted processes %system: CPU time spent in kernel space %iowait: CPU waiting for I/O %idle: CPU idle time tps: transactions per second kB_read/s and kB_wrtn/s: kilobytes read/written per second

Useful options: -c: show only CPU statistics (mutually exclusive with -d) -d: show only device statistics -k: display values in kilobytes (default is blocks) -p <device|ALL>: limit output to a specific device or all devices -x: display extended statistics <interval> <count>: repeat output every interval seconds, count times

iotop

iotop

provides a top‑like, real‑time view of disk I/O per process. It is not installed by default and requires the iotop package.

# yum -y install iotop
# iotop

The display shows columns such as PID, USER, DISK READ, DISK WRITE, and the command line that generated the I/O. Example output demonstrates processes with zero I/O, but when activity occurs the tool identifies the responsible processes.

Common options: -b: batch mode, suitable for logging -n NUM: refresh NUM times then exit -d SEC: set refresh interval to SEC seconds -p PID: monitor a specific process ID -u USER: monitor processes owned by

USER

lsof

lsof

(list open files) enumerates all files opened by processes. It must be run as root to see all information and requires the lsof package.

# yum -y install lsof
# lsof

Each line includes fields such as COMMAND, PID, USER, FD (file descriptor), TYPE (file type, e.g., DIR, REG), DEVICE, SIZE/OFF, NODE, and NAME (the exact file name).

Key field meanings: PID: process identifier USER: owner of the process FD: file descriptor number TYPE: file type (DIR, REG, etc.) DEVICE: device name SIZE: size of the file NODE: inode number

Typical usage examples: lsof -c abc – list files opened by processes whose command name contains "abc" lsof -p 1234 – list files opened by process ID 1234 lsof -g gid – show files opened by processes belonging to group ID

gid

lsof +d /DIR/

– display files opened under directory

/DIR/