Tracing Disk Access

[Robert Watson]

On Mon, 22 Nov 2004, Brian Fundakowski Feldman wrote:

> > I have set an idle timeout for the hard-disk. But when there is no
> > user activity there are frequent disk accesses.
> > How can one trace disk access?
> > I'd like to know the kind of access and on which files/directories/
> > nodes. I'd like to log on the console or on a memory disk file.
> 
> You should look to the MAC framework to provide you -- if not the entire
> solution -- at least insight into how and where you can do this.  If you
> were to do it at the disk device level, it would be a GEOM module,
> though. 

I recently added KTR tracing to geom_io.c which allows a trace of I/O
events both as they go up and down the GEOM stack, and as they're handed
off to disks, etc, so that should help provide detailed tracing of the
actual disk I/O's. 

For files/directories, hopefully we'll be ready to start merging some of
the Audit changes from the TrustedBSD branches to CVS in the next few
months, which will also provide a useful tracing mechanism at the higher
levels of the kernel. 

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert at fledge.watson.org      Principal Research Scientist, McAfee Research