Frequently Asked Question

What does iotop do that iostat doesn't?

iostat shows you which device is busy. iotop shows you which process is hammering it. It reads per-task I/O accounting from /proc/<pid>/io and presents a top-like view sorted by I/O rate. When a disk is at 100% %util and you need to know which program to interrogate or kill, iotop -o (which hides idle processes) gives you the answer almost immediately.

It needs root or CAP_NET_ADMIN to read the per-task counters, so run it with sudo. Useful flags are -a (cumulative since process start rather than current rate) and -P (group by process instead of thread). For a more sophisticated picture with stack traces of who is causing the I/O, the bcc tool biotop or the bpftrace one-liner equivalent goes deeper, but iotop alone solves the "which PID is thrashing my disk?" question that comes up every week.