LFCS 137 🐧 Disk Performance — iotop - KandZ

⏱️ Estimated read: 9 min | |

The previous chapter covered iostat, which reports the I/O activity of a device. This chapter covers iotop, which reports the I/O activity of a process. The distinction is the difference between “the disk is busy” and “this process is making the disk busy.” The LFCS exam tests this diagnostic chain: iostat identifies the saturated device, and iotop identifies the process responsible. The critical point is that iotop requires root privileges because it reads the per-process I/O statistics from the kernel’s /proc/<pid>/io interface . The -o flag filters the output to show only the processes that are actively doing I/O, which is the correct mode for diagnosis. The -b flag enables batch mode for logging and scripting.

Key point: iotop is the process-level I/O monitor. It shows the DISK READ and DISK WRITE rates for each process, the IO> percentage (the time the process spent waiting for I/O), and the SWAPIN percentage (the time spent waiting for swap). The -o flag shows only active processes. The -P flag shows processes instead of threads. The -b flag enables batch mode, and -n sets the number of iterations.

Why iotop requires a specific diagnostic sequence

The device-versus-process problem. iostat reports the device utilization. A %util of 100% means the device is saturated. It does not tell you which process is responsible. iotop fills that gap: it shows the per-process I/O rates, the user, and the command. The diagnostic chain is iostat first, then iotop .

The IO> column problem. The IO> column is the percentage of time the process spent waiting for I/O to complete. It is not the percentage of the disk’s bandwidth the process is using. A process at 99% in this column is blocked on I/O, not consuming bandwidth. Multiple processes can be at 99% simultaneously . The DISK READ and DISK WRITE columns are the actual throughput.

The root problem. iotop reads the /proc/<pid>/io file for each process. This file is readable only by root (or the process owner). Without root, iotop fails with a permission error or shows incomplete data . The sudo iotop is the standard invocation.

The thread problem. By default, iotop shows threads, not processes. A process with multiple threads appears multiple times, each with its own TID. The -P flag (or the p key in interactive mode) shows processes instead, aggregating the I/O of all threads into a single row . This is the correct view when identifying the process that is hammering the disk.

The trade-off. iotop is interactive and requires root. pidstat -d is the alternative when root is not available, but it requires the sysstat package and does not show the IO> percentage . For the exam, iotop is the primary tool because it is the direct answer to “which process is using the disk?”

a. The interactive mode and the `-o` flag

The iotop command without arguments starts the interactive mode. It refreshes every second and displays the process list sorted by I/O.

sudo iotop

The header shows the total disk read and write rates. The process list has these columns:

Column	Meaning
`TID`	Thread ID (or PID with `-P`)
`PRIO`	I/O priority (`be` = best-effort, `rt` = real-time)
`USER`	Owner
`DISK READ`	Read rate
`DISK WRITE`	Write rate
`SWAPIN`	Time waiting for swap
`IO>`	Time waiting for I/O
`COMMAND`	Process name

The -o flag (or the o key) filters the list to show only processes that are actively doing I/O. This is the most useful mode for diagnosis because it eliminates the noise of idle processes .

sudo iotop -o

The -P flag (or the p key) shows processes instead of threads. The -a flag (or the a key) shows accumulated I/O instead of the current rate.

sudo iotop -oP

b. The batch mode for logging

The -b flag enables batch mode, which is the non-interactive mode. The output is printed to stdout and can be redirected to a file. The -n flag sets the number of iterations, and the -d flag sets the delay between iterations.

# 10 iterations, 1-second intervals
sudo iotop -b -n 10

# 5 iterations, 5-second intervals
sudo iotop -b -n 5 -d 5

# Only active processes, batch mode
sudo iotop -b -o -n 5

The batch mode is the correct mode for a script that logs the I/O activity over time. The output includes the same columns as the interactive mode, but without the screen refresh .

The -t flag adds a timestamp to each line, which implies -b. The -k flag shows the sizes in kilobytes instead of the human-readable units, which is useful for scripting .

# Timestamped batch output
sudo iotop -b -t -n 10

c. Filtering by user and PID

The -u flag filters by user. The -p flag filters by PID. The -P flag shows processes instead of threads.

# Only processes owned by nginx
sudo iotop -u nginx

# Only a specific PID
sudo iotop -p 1234

# Processes, not threads
sudo iotop -P

The user filter accepts a username or a numeric UID. The + prefix forces the numeric interpretation . The PID filter monitors a single process, which is useful when you already know which process is suspect and want to see its I/O rate in isolation.

The -c flag shows the full command line instead of the process name. This is useful when the process name is generic (e.g., node or java) and the command line identifies the specific application.

sudo iotop -c -o

Complete Example Session

# ============================================
# PART 1: CHECK IF IOTOP IS INSTALLED
# ============================================

which iotop
# If not found:
sudo apt install iotop

# ============================================
# PART 2: RUN INTERACTIVE MODE
# ============================================

sudo iotop
# Shows all processes, sorted by I/O.
# Press o to show only active.
# Press p to show processes, not threads.
# Press q to quit.

# ============================================
# PART 3: RUN WITH -O FLAG
# ============================================

sudo iotop -o
# Shows only processes doing I/O.

# ============================================
# PART 4: SHOW PROCESSES, NOT THREADS
# ============================================

sudo iotop -oP
# Aggregates thread I/O into process rows.

# ============================================
# PART 5: FILTER BY USER
# ============================================

sudo iotop -u postgres
# Shows only the postgres user's processes.

# ============================================
# PART 6: FILTER BY PID
# ============================================

sudo iotop -p 1234
# Monitors a single process.

# ============================================
# PART 7: BATCH MODE
# ============================================

sudo iotop -b -n 5 -d 1
# Five iterations, one-second intervals.

# ============================================
# PART 8: LOG TO FILE
# ============================================

sudo iotop -b -n 60 -d 1 > /var/log/iotop.log
# Logs one minute of I/O activity.

# ============================================
# PART 9: DIAGNOSTIC CHAIN
# ============================================

iostat -xz 1
# Identify the saturated device.
sudo iotop -oP
# Identify the process responsible.

The nine parts trace the iotop workflow: installation check, interactive mode, -o flag, -P flag, user filter, PID filter, batch mode, logging, and the diagnostic chain.

Quick Reference

`iotop` Options

Option	Purpose
`-o`	Show only active I/O
`-P`	Show processes, not threads
`-b`	Batch mode
`-n <num>`	Number of iterations
`-d <sec>`	Delay between iterations
`-u <user>`	Filter by user
`-p <pid>`	Filter by PID
`-a`	Accumulated I/O
`-t`	Timestamp
`-k`	Kilobytes
`-c`	Full command line

Interactive Keys

Key	Action
`o`	Toggle only-active
`p`	Toggle process/thread
`a`	Toggle accumulated
`r`	Reverse sort
`left/right`	Change sort column
`q`	Quit

Columns

Column	Meaning
`TID`	Thread ID
`PRIO`	I/O priority
`USER`	Owner
`DISK READ`	Read rate
`DISK WRITE`	Write rate
`SWAPIN`	Swap wait %
`IO>`	I/O wait %
`COMMAND`	Process name

Diagnostic Chain

Tool	Question
`iostat`	Which device is saturated?
`iotop`	Which process is responsible?

Best Practices

✅ Do This:

sudo iotop -oP
<!-- Show only active processes -->                  # ✅

sudo iotop -b -n 10 -d 1 > iotop.log
<!-- Log in batch mode -->                           # ✅

iostat -xz 1
<!-- Identify the device first -->                   # ✅

❌ Don’t Do This:

# Run iotop without root
<!-- Permission denied -->                           # ❌

# Interpret IO> as bandwidth usage
<!-- It is the percentage of time waiting -->        # ❌

# Use the default thread view for diagnosis
<!-- Threads fragment the process view -->           # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
`iotop` not found	Package not installed	`apt install iotop`
Permission denied	Not root	`sudo iotop`
Process appears multiple times	Thread view	`-P` flag
IO> high but disk idle	Process blocked on I/O	Check `iostat`
Batch output unreadable	No `-o`	Add `-o`

Real-World Examples

1. Interactive

sudo iotop

2. Only Active

sudo iotop -o

3. Processes Only

sudo iotop -P

4. User Filter

sudo iotop -u nginx

5. PID Filter

sudo iotop -p 1234

6. Batch Mode

sudo iotop -b -n 5

7. Log to File

sudo iotop -b -n 60 > iotop.log

8. Timestamp

sudo iotop -b -t -n 5

9. Full Command

sudo iotop -c -o

10. Diagnostic Chain

iostat -xz 1 && sudo iotop -oP

Visual

Diagnostic Chain

┌──────────────────────────────────────────────┐
│  iostat -xz 1                                │
│  → Device sda at 100% util                   │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  sudo iotop -oP                              │
│  → postgres writing 40 MB/s                  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  The process is identified.                  │
└──────────────────────────────────────────────┘

`iotop` Output

┌──────────────────────────────────────────────┐
│  Total DISK READ: 12.34 M/s | WRITE: 45.67 M/s│
├──────────────────────────────────────────────┤
│  TID  PRIO  USER     DISK READ  DISK WRITE   │
│  1234 be/4  postgres 0.00 B/s   42.56 M/s    │
│  5678 be/4  www-data 12.34 M/s  0.00 B/s     │
└──────────────────────────────────────────────┘

Summary

Item	Value
Tool	`iotop`
Requires	Root
Default view	Threads
Process view	`-P`
Only active	`-o`
Batch mode	`-b`
Iterations	`-n`
Delay	`-d`
User filter	`-u`
PID filter	`-p`
Key column	`IO>` (wait %)

Key takeaways:

iotop is the process-level I/O monitor. It shows the per-process read and write rates, the user, and the command. It requires root because it reads the /proc/<pid>/io files .
The -o flag is the diagnostic mode. It filters the list to show only processes that are actively doing I/O. The idle processes are noise .
The -P flag shows processes, not threads. The default view is threads, which fragments a multi-threaded process into multiple rows. The process view aggregates them .
The IO> column is the wait percentage, not the bandwidth. A process at 99% is blocked on I/O, not consuming 99% of the disk. The DISK READ and DISK WRITE columns are the actual throughput .
The diagnostic chain is iostat then iotop. iostat identifies the saturated device. iotop identifies the process responsible. The two tools are complementary .

Remember: iostat answers “which device is busy?” iotop answers “which process is making it busy?” The exam tests the diagnostic chain and the interpretation of the IO> column. The -o flag is the default for diagnosis. The -P flag is the default for process identification. The batch mode is for logging.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!

Why iotop requires a specific diagnostic sequence

a. The interactive mode and the -o flag

b. The batch mode for logging

c. Filtering by user and PID

Complete Example Session

Quick Reference

iotop Options

Interactive Keys

Columns

Diagnostic Chain

Best Practices

Common Pitfalls

Real-World Examples

1. Interactive

2. Only Active

3. Processes Only

4. User Filter

5. PID Filter

6. Batch Mode

7. Log to File

8. Timestamp

9. Full Command

10. Diagnostic Chain

Visual

Diagnostic Chain

iotop Output

Summary

a. The interactive mode and the `-o` flag

`iotop` Options

`iotop` Output