Here's 3 commands I've found useful over the past year to see:
- how much filesystem activity is going on
IOPS (i/o operations per second), approximately - which applications are causing the most activity
- which files or paths in the filesystem are being accessed
I will assume some unix familiarity here; if you don't know where these commands go, then you probably don't understand the output either. Come back after you've learned more. All command lines are a single line, and appear below in courier bold.
Also, you need to be root for this.
I like to keep past outputs, and in a separate directory to contain clutter, so if you want to use these commands without modification then first do (one time only):
I like to keep past outputs, and in a separate directory to contain clutter, so if you want to use these commands without modification then first do (one time only):
mkdir fs_usage
1. Collect output from fs_usage
[42]original-mac 10:21:56 1082 ~# fs=$[fs+1]; fsd=0216; time fs_usage -w -f filesys | grep '/.*/' | head -10000 > fs_usage/fs.$fsd.$fs
real 1m18.214s
user 0m1.379s
sys 0m1.428s
Here, only looking for the fs_usage output lines with pathnames (at least 2 slashes), the first 10k instances. You can do more or less... This took 78 seconds, which tells me the system is "fairly idle", at least mine, with the normal set of applications that I usually have open. I have seen it complete in as little as two or three seconds.
I set $fsd as the date, and then increment the filename each time; this is just a personal packrat preference, but you can just use a single file in /tmp if you like.
In this form, it's easy to wrap with a while or
for sample in {1..10}; do ...; doneif you want to get ten samples, and then compare/combine the outputs. Putting output from time into a separate file left as exercise for the reader.
for sample in {1..10}; do ...; doneif you want to get ten samples, and then compare/combine the outputs. Putting output from time into a separate file left as exercise for the reader.
Note these do not directly correspond to disk accesses (reads/writes), just general i/o activity.
'Activity Monitor' provides a graph of IOPS (or so it says); there are other benchmark programs if you want to check your disk (what's your favorite?).
2. See which applications are issuing requests.
Note with fs_usage '-w' wide output, the application name starts in column 234.
[37]original-mac 10:02:40 1078 ~# cat fs_usage/fs.$fsd.$fs | cut -c234- | sort | uniq -c | sort -n | tail -25
67 fseventsd.1560736
67 fseventsd.3241
67 fseventsd.639202
80 CalendarAgent.2319030
81 mds.2317581
96 Dropbox.6042
114 leapd.2991
119 mdworker.2292251
120 fseventsd.3427
120 fseventsd.3428
131 Google Chrome.1506982
132 CalendarAgent.2319032
148 Google Chrome.1507028
152 launchd.210
154 opendirectoryd.2318992
154 opendirectoryd.2318994
156 Google Chrome.1507026
156 opendirectoryd.2318977
160 opendirectoryd.2318972
202 dbfseventsd.626141
206 mtmfs.780
230 Google Chrome.1506961
288 com.apple.iCloud.2319050
376 mtmd.781
6021 Google Chrome.1506955
Google Chrome is the majority of the activity... not particularly surprising (I currently have 30+ tabs open).
3. See what directories and files are being accessed
[36]original-mac 10:01:26 1077 ~# cat fs_usage/fs.$fsd.$fs | cut -c57-200 | sort | cut -c1-60 | uniq -c | sort -n | tail -33
20 /Users/todd/Library/Application%2525252520Support
20 /private/var/folders/98/vpw5gnnx1xg_9l3vjv3cc7r00000gn/T/.co
20 0 /dev/disk0s2
20 private/var/folders/98/vpw5gnnx1xg_9l3vjv3cc7r00000gn/T/.com
21 /Applications/TextEdit.app
22 /Users/todd/Library/Application%252520Support>>>>>>>>>>>>>>>
23 /Users/todd/Library
23 /Users/todd/Library/Application%20Support>>>>>>>>>>>>>>>>>>>
23 /Users/todd/Library/Application%2520Support>>>>>>>>>>>>>>>>>
24 /Users/todd/.dropbox/PENDING_MN7VKR
24 /Users/todd/.dropbox/UPDATED_Xp1v55
24 /Users/todd/Library/Application Support/Google/Chrome/.com.g
24 /Users/todd/Library/Application Support/Google/Chrome/Local
25 private/var/folders/98/vpw5gnnx1xg_9l3vjv3cc7r00000gn/T
29 /Users/todd/Library/Saved Application State/com.apple.Termin
31 /Users/todd
31 /Users/todd/Library/Calendars
32 00 /dev/disk0s3
36 /Users/todd/Library/Application Support/iCloud>>>>>>>>>>>>>>
40 /Users/todd/Library/Calendars/CE0DC09B-CC04-47D0-9217-E0E295
42 /Users/todd/Library/Preferences/com.apple.security.revocatio
47 /Volumes/rescue
58 /Users/todd/Library/Preferences/VMware Fusion/preferences
72 /System/Library/CoreServices/backupd.bundle/Contents/Resourc
89 /Users/todd/Library/Calendars/Calendar Cache-wal
104 /Users/todd/Library/Calendars/Calendar Cache-journal
114 /dev/console
115 /Users/todd/Library/Application Support/Google/Chrome
123 /private/var/folders/98/vpw5gnnx1xg_9l3vjv3cc7r00000gn/T
216 /System/Library/PrivateFrameworks/CalendarAgent.framework/Ex
250 /Users/todd/Library/Application Support/Google/Chrome/Safe B
454 0 /dev/disk0s3
6487 /Users/todd/Library/Application Support/Google/Chrome/Defaul
Again, the fs_usage output has the pathname (since we explicitly grep'd for one) starting around column 57.. then I'm only looking at the first 60 characters of that path and aggregating to get a useful summary; you can use shorter or longer, or just search the raw output for specific files.
Mostly Chrome accessing my profile here. Not sure about the /dev/disk accesses, or why some lines have '>>>>..' in them... in the context of the full fs_usage output it might be more apparent. However, for my purposes of approximately finding out what is going on, these are useful.
You need to run this a few times on yoru system to determine a baseline--i.e., what normal levels of activity are, and which applications are generating them.
DISKS ARE SLOW, limited to one head per platter, and you have to wait for it to rotate into place.. a limiting resource (if you have an SSD or hybrid disk or RAID with battery-backed write-cache memory--they are a little better). Sometimes you can't avoid them (e.g., you have to save your work). But if/when your system starts slowing down, this can provide a little insight into what may be the bottleneck, and what unnecessary items you can shut down.
