---
name: "iosnoop"
section: "1m"
platform: "macos"
package: "dtrace"
version: "413"
release: "macOS 26.5"
platforms: ["macos"]
url: "https://new.carta.tech/iosnoop"
---

# iosnoop(1m)

snoop I/O events as they occur. Uses DTrace.

## NAME

iosnoop - snoop I/O events as they occur. Uses DTrace.

## SYNOPSIS

**iosnoop** \[-a\|-A\|-Deghinostv\] \[-d device\] \[-f filename\] \[-m mount\_point\] \[-n name\] \[-p PID\]

## DESCRIPTION

iosnoop prints I/O events as they happen, with useful details such as UID, PID, block number, size, filename, etc.

This is useful to determine the process responsible for  using the disks, as well as details on what activity the process is requesting. Behaviour such as random or sequential I/O can be observed by reading the block numbers.

Since this uses DTrace, only users with root privileges can run this command.

## OPTIONS

- \-a

  print all data

- \-A

  dump all data, space delimited

- \-D

  print time delta, us (elapsed)

- \-e

  print device name

- \-i

  print device instance

- \-N

  print major and minor numbers

- \-o

  print disk delta time, us

- \-s

  print start time, us

- \-t

  print completion time, us

- \-v

  print completion time, string

- \-d device

  instance name to snoop (eg, dad0)

- \-f filename

  full pathname of file to snoop

- \-m mount\_point

  mountpoint for filesystem to snoop

- \-n name

  process name

- \-p PID

  process ID

## EXAMPLES

- Default output, print I/O activity as it occurs,

  \#  **iosnoop**

- Print human readable timestamps,

  \#  **iosnoop** -v

- Print major and minor numbers,

  \# **iosnoop** -N

- Snoop events on the root filesystem only,

  \# **iosnoop** -m /

## FIELDS

- UID

  User ID

- PID

  Process ID

- PPID

  Parent Process ID

- COMM

  command name for the process

- ARGS

  argument listing for the process

- SIZE

  size of the operation, bytes

- BLOCK

  disk block for the operation (location. relative to this filesystem. more useful with the -N option to print major and minor numbers)

- STIME

  timestamp for the disk request, us

- TIME

  timestamp for the disk completion, us

- DELTA

  elapsed time from request to completion, us (this is the elapsed  time from the disk request (strategy) to the disk completion (iodone))

- DTIME

  time for disk to complete request, us (this is the time for the  disk to complete that event since it's last event (time between iodones), or, the time to the strategy if the disk had been idle)

- STRTIME

  timestamp for the disk completion, string

- DEVICE

  device name

- INS

  device instance number

- D

  direction, Read or Write

- MOUNT

  mount point

- FILE

  filename (basename) for I/O operation

## NOTES

When filtering on PID or process name, be aware that poor disk event times may be due to events that have been filtered away, for example another process that may be seeking the disk heads elsewhere.

## DOCUMENTATION

See the DTraceToolkit for further documentation under the  Docs directory. The DTraceToolkit docs may include full worked examples with verbose descriptions explaining the output.

## EXIT

iosnoop will run forever until Ctrl-C is hit.

## AUTHOR

Brendan Gregg \[Sydney, Australia\]

## SEE ALSO

iotop(1M), dtrace(1M)