Sniff HDD Reads and Writes?

Discussion in 'all things UNIX' started by Searching_ _ _, May 30, 2011.

Thread Status:
Not open for further replies.
  1. Searching_ _ _

    Searching_ _ _ Registered Member

    Joined:
    Jan 2, 2008
    Posts:
    1,988
    Location:
    iAnywhere
    Like is done with a Hub on a network, can I capture data going to the HDD regardless if the HDD is mounted or not?
     
  2. mvario

    mvario Registered Member

    Joined:
    Sep 16, 2008
    Posts:
    339
    Location:
    Haddonfield, IL
    Try iotop or daemonfs
     
  3. Searching_ _ _

    Searching_ _ _ Registered Member

    Joined:
    Jan 2, 2008
    Posts:
    1,988
    Location:
    iAnywhere
    Thanks, I'll look those up.
     
  4. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    8,695
    HDD mounted? You mean partitions, right?
    And going to the HDD from where? Memory? Network? Both? Else?

    Mrk
     
  5. Searching_ _ _

    Searching_ _ _ Registered Member

    Joined:
    Jan 2, 2008
    Posts:
    1,988
    Location:
    iAnywhere
    Yep. Brain fade.
    Exactly. I would like to MITM the HDD.

    iotop doesn't show all HDD activity, only activity started by host processes.
    It also doesn't function as expected, using the -a option some processes do not remain, they pop up then disappear with no cumulative.
     
  6. mvario

    mvario Registered Member

    Joined:
    Sep 16, 2008
    Posts:
    339
    Location:
    Haddonfield, IL
    I found this:
    http://ubuntuforums.org/showthread.php?p=2415252#post2415252
    might be of help.
     
  7. Searching_ _ _

    Searching_ _ _ Registered Member

    Joined:
    Jan 2, 2008
    Posts:
    1,988
    Location:
    iAnywhere
    WooHoo! Lots of activity.

    Works much better than iotop, except there are entries that don't need to be displayed.

    How would I exclude entries from displaying?
    For example:
    Code:
    [122468.692488] sudo(13946): READ block 79574 on loop0
    [122468.735831] loop0(470): READ block 80608 on sr0
    Or, as an example, should I just add "grep -i usb" to "dmesg -c"?
    Can I chain multiple display filters? Ex. grep -i usb,tty,debugfs,pdq
     
Loading...
Thread Status:
Not open for further replies.