iotop Cheatsheet

Disk IO.

Overview

iotop is the interactive disk-IO monitor that shows per-process disk activity. When “disk is slow” needs to become “process X is doing 800MB/s of writes,” iotop is the tool. Five keyboard shortcuts cover almost every investigative use case.

• Per-process disk IO. Read and write rates per process. Catches the disk hog directly.
• Sortable view. Sort by read, write, or total IO. Fast attribution to the actual culprit.
• Cumulative mode. -a shows accumulated IO since start. Useful for session-long analysis.
• Only-active plus batch mode. -o filters to processes with current IO; -b outputs non-interactively for scripts.

The approach

Three habits separate fluent iotop from beginner iotop: filter to active processes, sort by the dimension that matters, and drill into the offending process with companion tools.

• iotop -o. Show only processes currently doing IO. Cuts the noise from idle processes.
• iotop -a. Cumulative IO across the session. Long investigations need accumulated totals, not instantaneous rates.
• iotop -P plus -b. -P shows processes only; -b writes batch-mode output suitable for scripts and automation.
• R and W keys. Sort by read or write rate. The right key finds the right hog quickly.

Why this compounds

iotop fluency is high-leverage because the same tool serves every disk-flavoured investigation the team runs. Each session teaches a little more about how the workload uses storage.

• Faster IO investigation. Fluent iotop produces fast root cause on disk-flavoured incidents. MTTR drops measurably.
• Linux IO mental model. Each session teaches the IO subsystem. Investigations get faster as the model matures.
• Cost attribution. Specific processes tied to disk load supports capacity and cost analysis.
• Year-one investment, year-two habit. The first year establishes fluency under pressure. Subsequent years extend it.