Demonstrations of filetop, the Linux eBPF/bcc version.


filetop shows reads and writes by file, with process details. For example:

# ./filetop -C
Tracing... Output every 1 secs. Hit Ctrl-C to end

08:00:23 loadavg: 0.91 0.33 0.23 3/286 26635

PID    COMM             READS  WRITES R_Kb    W_Kb    T FILE
26628  ld               161    186    643     152     R built-in.o
26634  cc1              1      0      200     0       R autoconf.h
26618  cc1              1      0      200     0       R autoconf.h
26634  cc1              12     0      192     0       R tracepoint.h
26584  cc1              2      0      143     0       R mm.h
26634  cc1              2      0      143     0       R mm.h
26631  make             34     0      136     0       R auto.conf
26634  cc1              1      0      98      0       R fs.h
26584  cc1              1      0      98      0       R fs.h
26634  cc1              1      0      91      0       R sched.h
26634  cc1              1      0      78      0       R printk.c
26634  cc1              3      0      73      0       R mmzone.h
26628  ld               18     0      72      0       R hibernate.o
26628  ld               16     0      64      0       R suspend.o
26628  ld               16     0      64      0       R snapshot.o
26628  ld               16     0      64      0       R qos.o
26628  ld               13     0      52      0       R main.o
26628  ld               12     0      52      0       R swap.o
[...]

This shows various files read and written during a Linux kernel build. By
default the output is sorted by the total read size in Kbytes (R_Kb). Sorting
order can be changed via -s option. This is instrumenting at the VFS interface,
so this is reads and writes that may return entirely from the file system cache
(page cache).

While not printed, the average read and write size can be calculated by
dividing R_Kb by READS, and the same for writes.

The "T" column indicates the type of the file: "R" for regular files, "S" for
sockets, and "O" for other (including pipes). By default only regular files are
shown; use the -a option to show all file types.

This script works by tracing the vfs_read() and vfs_write() functions using
kernel dynamic tracing, which instruments explicit read and write calls. If
files are read or written using another means (eg, via mmap()), then they
will not be visible using this tool.

This should be useful for file system workload characterization when analyzing
the performance of applications.

Note that tracing VFS level reads and writes can be a frequent activity, and
this tool can begin to cost measurable overhead at high I/O rates.


A -C option will stop clearing the screen, and -r with a number will restrict
the output to that many rows (20 by default). For example, not clearing
the screen and showing the top 5 only:

# ./filetop -Cr 5
Tracing... Output every 1 secs. Hit Ctrl-C to end

08:05:11 loadavg: 0.75 0.35 0.25 3/285 822

PID    COMM             READS  WRITES R_Kb    W_Kb    T FILE
32672  cksum            5006   0      320384  0       R data1
809    run              2      0      8       0       R nsswitch.conf
811    run              2      0      8       0       R nsswitch.conf
804    chown            2      0      8       0       R nsswitch.conf

08:05:12 loadavg: 0.75 0.35 0.25 3/285 845

PID    COMM             READS  WRITES R_Kb    W_Kb    T FILE
32672  cksum            4986   0      319104  0       R data1
845    chown            2      0      8       0       R nsswitch.conf
828    run              2      0      8       0       R nsswitch.conf
835    run              2      0      8       0       R nsswitch.conf
830    run              2      0      8       0       R nsswitch.conf

08:05:13 loadavg: 0.75 0.35 0.25 3/285 868

PID    COMM             READS  WRITES R_Kb    W_Kb    T FILE
32672  cksum            4985   0      319040  0       R data1
857    run              2      0      8       0       R nsswitch.conf
858    run              2      0      8       0       R nsswitch.conf
859    run              2      0      8       0       R nsswitch.conf
848    run              2      0      8       0       R nsswitch.conf
[...]

This output shows a cksum command reading data1.


An optional interval and optional count can also be added to the end of the
command line. For example, for 1 second interval, and 3 summaries in total:

# ./filetop -Cr 5 -a 1 3
Tracing... Output every 1 secs. Hit Ctrl-C to end

08:08:20 loadavg: 0.30 0.42 0.31 3/282 5187

PID    COMM             READS  WRITES R_Kb    W_Kb    T FILE
12421  sshd             14101  0      225616  0       O ptmx
12296  sshd             4      0      64      0       O ptmx
12421  sshd             3      14104  48      778     S TCP
5178   run              2      0      8       0       R nsswitch.conf
5165   run              2      0      8       0       R nsswitch.conf

08:08:21 loadavg: 0.30 0.42 0.31 5/282 5210

PID    COMM             READS  WRITES R_Kb    W_Kb    T FILE
12421  sshd             9159   0      146544  0       O ptmx
12421  sshd             3      9161   48      534     S TCP
12296  sshd             1      0      16      0       S TCP
5188   run              2      0      8       0       R nsswitch.conf
5203   run              2      0      8       0       R nsswitch.conf

08:08:22 loadavg: 0.30 0.42 0.31 2/282 5233

PID    COMM             READS  WRITES R_Kb    W_Kb    T FILE
12421  sshd             26166  0      418656  0       O ptmx
12421  sshd             4      26171  64      1385    S TCP
12296  sshd             1      0      16      0       O ptmx
5214   run              2      0      8       0       R nsswitch.conf
5227   run              2      0      8       0       R nsswitch.conf
Detaching...

This example shows the -a option to include all file types. It caught heavy
socket I/O from an sshd process, showing up as non-regular file types (the "O"
for other, and "S" for socket, in the type column: "T").


USAGE message:

# ./filetop -h
usage: filetop.py [-h] [-a] [-C] [-r MAXROWS] [-p PID] [interval] [count]

File reads and writes by process

positional arguments:
  interval              output interval, in seconds
  count                 number of outputs

optional arguments:
  -h, --help            show this help message and exit
  -a, --all-files       include non-regular file types (sockets, FIFOs, etc)
  -C, --noclear         don't clear the screen
  -r MAXROWS, --maxrows MAXROWS
                        maximum rows to print, default 20
  -s {reads,writes,rbytes,wbytes}, --sort {reads,writes,rbytes,wbytes}
                        sort column, default rbytes
  -p PID, --pid PID     trace this PID only

examples:
    ./filetop            # file I/O top, 1 second refresh
    ./filetop -C         # don't clear the screen
    ./filetop -p 181     # PID 181 only
    ./filetop 5          # 5 second summaries
    ./filetop 5 10       # 5 second summaries, 10 times only