I/O sniffing

I coined an expression I/O sniffing for listening to the system at block level like this:

initiator XYZ requests block 4711 from device 0815 initiator BLA writes block 1234 to device 9876

You can do I/O sniffing using the command blktrace. blktrace will show you every request that goes to the disk.

Example:

# blktrace -d /dev/sdg -o - | blkparse -i - 
[...]
  8,96   7      106     0.373952974 11364  D   W 0 + 8 [kworker/7:2]
  8,96   7      107     0.374456639    47  C   W 0 + 8 [0]

The RWBS(D) field can be a combination of

R : Read
W : Write
D : Block discard
B : Barrier operation
S : Synchronous operations

See also

• blktrace man page
• blkparse man page
• http://unix.stackexchange.com/questions/105610/how-does-blktrace-work
• http://unix.stackexchange.com/questions/105612/why-does-blktrace-only-write-blocks-of-8