Mac
(windows and linux, keep reading)
What it probably is: spotlight indexing.
If you're just hooking up a drive to copy some data or look for something, then this can be a hindrance to your work.
Verify that it is this process with:
sudo fs_usage
this will show all I/O activity, which will be a lot because it will include every line of text coming out to the terminal as well. Filter it with something like
sudo fs_usage | egrep -v 'screen|grep|head' | head -20
If you see mdworker, that's spotlight indexing going on.
If you see backupd, that's Time Machine (but you may have noticed the spinning icon in the menu bar).
Turn off indexing with:
mdutil -i off /Volumes/mountname
It may take 30 seconds or so (depending how busy it is) before you see
Indexing disabled.
You can turn it back on later by specifying 'on' instead of 'off'.
There are many other usages; you can use fs_usage to find what configuration or plist file(s) a program is using, where your data is going to on disk, etc.
Windows
On windows, get fsmon; it's one of the sysinternals tools.
regmon will do the same thing for registry accesses.
I've used fsmon to discover trojan processes before.
Windows == virus.
Linux
atop is supposed to come with ubuntu.
I don't think it gives specific paths in output, but once you have the pid you can connect with strace and just look at the IO syscalls, or use lsof to find which files are currently in use.
any other tools of note?
(windows and linux, keep reading)
What it probably is: spotlight indexing.
If you're just hooking up a drive to copy some data or look for something, then this can be a hindrance to your work.
Verify that it is this process with:
sudo fs_usage
this will show all I/O activity, which will be a lot because it will include every line of text coming out to the terminal as well. Filter it with something like
sudo fs_usage | egrep -v 'screen|grep|head' | head -20
If you see mdworker, that's spotlight indexing going on.
If you see backupd, that's Time Machine (but you may have noticed the spinning icon in the menu bar).
Turn off indexing with:
mdutil -i off /Volumes/mountname
It may take 30 seconds or so (depending how busy it is) before you see
Indexing disabled.
You can turn it back on later by specifying 'on' instead of 'off'.
There are many other usages; you can use fs_usage to find what configuration or plist file(s) a program is using, where your data is going to on disk, etc.
Here's a MacWorld article: Watch file system activity in real time
Windows
On windows, get fsmon; it's one of the sysinternals tools.
regmon will do the same thing for registry accesses.
I've used fsmon to discover trojan processes before.
Windows == virus.
Linux
atop is supposed to come with ubuntu.
I don't think it gives specific paths in output, but once you have the pid you can connect with strace and just look at the IO syscalls, or use lsof to find which files are currently in use.
any other tools of note?
No comments:
Post a Comment