iotop Command: Tutorial & Examples

Analyze and monitor disk I/O usage on Linux systems

The iotop command is a specialized monitoring tool for Linux servers that provides real-time data about disk I/O usage by processes and threads. It helps system administrators identify which processes are generating the most disk activity, enabling efficient troubleshooting of performance issues related to disk input/output operations.

By using iotop, you can observe live disk read/write rates, accumulated I/O, and other statistics that are crucial for maintaining optimal server performance. This article explains how iotop works, its usage, common options, troubleshooting tips, and practical examples.

How iotop Works

iotop leverages Linux kernel features to monitor disk I/O activity per process or thread. Specifically, it requires the kernel to support task I/O accounting, which depends on the following kernel configuration options being enabled:

CONFIG_TASK_DELAY_ACCT
CONFIG_TASK_IO_ACCOUNTING

These options allow the kernel to track how much I/O each process performs. iotop reads this data from the /proc filesystem and presents it in an interactive terminal interface.

Because iotop accesses kernel accounting data, it requires root privileges (or appropriate capabilities) to display information for all processes. Without root, iotop can only show information about processes owned by the current user.

What iotop Displays

When running, iotop shows a table with columns that provide detailed information about the disk I/O activity of processes or threads. The main columns include:

TID: Thread ID or process ID.
PRIO: Kernel scheduling priority.
USER: The user owning the process.
DISK READ: Data read from disk in bytes or kilobytes per second.
DISK WRITE: Data written to disk in bytes or kilobytes per second.
SWAPIN: Percentage of time the process has waited for swapin (paging in from swap).
IO>: Percentage of time the process spent waiting on I/O.
COMMAND: The command name or process name.

Example output during active disk I/O might look like this:

Total DISK READ: 1.20 M/s | Total DISK WRITE: 512.00 K/s
TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN  IO>    COMMAND
2345 be/4  root     512.00 K/s  0.00 B/s    0.00 %  10.00 %  rsync
6789 be/4  mysql    0.00 B/s    1.20 M/s    0.00 %  15.00 %  mysqld
1122 be/4  user1    128.00 K/s  256.00 K/s  0.00 %  5.00 %   backup.sh

This live updating display helps identify which processes are responsible for disk activity and their impact on system performance.

Installation

iotop is not always installed by default. You can install it using your distribution’s package manager.

On Debian or Ubuntu:

sudo apt-get install iotop

On CentOS, Fedora, or RHEL:

sudo yum install iotop

sudo dnf install iotop

Ensure you run iotop with root privileges for full functionality.

Basic Usage

To invoke iotop with default interactive monitoring, run:

sudo iotop

This will open a terminal interface showing disk I/O usage by processes in real-time.

To exit, press q or Ctrl+C.

Sorting The Output

While running interactively, iotop supports sorting the display by different criteria. Pressing the following keys changes the sorting order:

o: Sort by disk read rate (descending).
p: Sort by disk write rate (descending).
a: Sort by accumulated I/O (descending).
u: Sort by process ID (ascending).
P: Sort by process name (ascending).

For example, to focus on processes writing most data to disk, press p while iotop is running.

Filtering The Output

iotop allows filtering processes shown based on user or process ID.

To show only processes owned by a user (e.g., "john"):
```
sudo iotop -u john
```
To monitor specific processes by their IDs (e.g., PID 123 and 456):
```
sudo iotop -p 123 -p 456
```

Filtering is useful when narrowing down to suspicious or heavy I/O processes among many.

Additional Options

Some useful iotop options include:

-o: Show only processes actively doing I/O (skips idle).
-b: Batch mode. Print output once or multiple times and exit (useful for logging).
-n NUM: Number of iterations before exiting in batch mode.
-d SECONDS: Delay between iterations in batch mode (default 1 second).
-k: Display I/O in kilobytes per second instead of bytes.
-q: Quiet mode. Suppress header and summary lines.

Example: Run iotop in batch mode for 5 iterations with a 2-second delay:

sudo iotop -b -n 5 -d 2

This outputs snapshots of disk I/O every 2 seconds, useful for logging or scripting.

Common Errors And Troubleshooting

Permission Denied: Running iotop without root privileges limits visibility. Use sudo or run as root.
Kernel Support Missing: If iotop reports it cannot find kernel accounting info, ensure your kernel has CONFIG_TASK_DELAY_ACCT and CONFIG_TASK_IO_ACCOUNTING enabled.
No Output or Zero I/O: Sometimes processes may not show I/O due to short-lived operations or buffering. Monitor over time for spikes.
Terminal Issues: In some environments, terminal resizing or compatibility issues may affect display.

Security Considerations

Since iotop requires elevated privileges, avoid running it unnecessarily as root. Use it only for monitoring and troubleshooting. Be cautious when running batch mode logging to files to avoid exposing sensitive process data.

Performance Considerations

iotop itself has minimal performance impact but running it with very short delays in batch mode can increase overhead. Use appropriate intervals to balance monitoring granularity and system load.

Tips And Best Practices

Use the interactive sorting keys to quickly identify heavy disk readers or writers.
Combine filtering by user or PID with sorting for precise monitoring.
Use batch mode to log disk I/O over time for historical analysis.
Regularly monitor disk I/O patterns to detect abnormal activity early.
Remember that high I/O can indicate legitimate heavy workloads or potential issues like disk thrashing.

Possible Alternatives Or Related Commands

pidstat: Monitors individual process statistics including I/O.
dstat: General system resource statistics including disk I/O.
[iotop] is specialized for disk I/O per process, whereas top focuses on CPU and memory.
vmstat: System-wide I/O and virtual memory statistics.

Cheatsheet

Start monitoring with root privileges:
```
sudo iotop
```
Show only active I/O processes:
```
sudo iotop -o
```
Filter by user:
```
sudo iotop -u username
```
Filter by PID:
```
sudo iotop -p PID
```
Run in batch mode (5 iterations, 1-second delay):
```
sudo iotop -b -n 5 -d 1
```

Interactive sorting keys:

o - sort by disk read
p - sort by disk write
a - sort by accumulated I/O
u - sort by PID
P - sort by process name

Real-World Use Cases

Detecting runaway processes causing heavy disk writes leading to slow application response.
Monitoring backup jobs to confirm expected disk throughput.
Identifying processes causing disk thrashing and swapping.
Analyzing disk I/O before and after system tuning or hardware changes.
Logging disk activity during performance tests for troubleshooting.