Show files being accessed most in a short time period

Question

So I've got a server that's struggling under the weight of several Wordpress installs. Things are relatively well cached (I am planning to improve things anyway) but I can quickly see that disk IO is extremely high.

I have used iotop to see that it's mostly PHP honking on the disk but I would really like to know which files. I feel that if I knew that, I might be able to spot additional issues or find a bottleneck that could be widened (move stuff to ram-disk, etc).

So I'm looking for a command that will give me a list of open files, ranked by their IO over the time since the command began. Or something that works on a set period, like 60 seconds.

_{Note: I'm looking for more than lsof — I need the output ranked by total IO throughput.}

Answer 1

Try inotifywatch.

From the man page:

% inotifywatch -v -e access -e modify -t 60 -r ~/.beagle
Establishing watches...
Setting up watch(es) on /home/rohan/.beagle
OK, /home/rohan/.beagle is now being watched.
Total of 302 watches.
Finished establishing watches, now collecting statistics.
Will listen for events for 60 seconds.
total  access  modify  filename
1436   1074    362     /home/rohan/.beagle/Indexes/FileSystemIndex/PrimaryIndex/
1323   1053    270     /home/rohan/.beagle/Indexes/FileSystemIndex/SecondaryIndex/
303    116     187     /home/rohan/.beagle/Indexes/KMailIndex/PrimaryIndex/
261    74      187     /home/rohan/.beagle/TextCache/
206    0       206     /home/rohan/.beagle/Log/
42     0       42      /home/rohan/.beagle/Indexes/FileSystemIndex/Locks/
18     6       12      /home/rohan/.beagle/Indexes/FileSystemIndex/
12     0       12      /home/rohan/.beagle/Indexes/KMailIndex/Locks/
3      0       3       /home/rohan/.beagle/TextCache/54/
3      0       3       /home/rohan/.beagle/TextCache/bc/
3      0       3       /home/rohan/.beagle/TextCache/20/
3      0       3       /home/rohan/.beagle/TextCache/62/
2      2       0       /home/rohan/.beagle/Indexes/KMailIndex/SecondaryIndex/