I need to identify what process is writing non-stop on the Disk.
I tried to run prstat -t to get the list of the processes running, but I can't identify/find which process it is.
running df -k , I can see that the space on a given path of the Disk is continuously decreasing.
after killing all the processes (and closing all the external connections) that could ever write on the disk , still there is something that writes on it.
OS Solaris 10
It won't show the actual IO operations, but you can also use the fuser utility to identify process(es) using the filesystem in any way, even those that don't cause actual IO, or do IO in ways that can't be traced back to a particular process (mmap() of files is one, where a file can be mmap()'d by multiple processes):
Synopsis
/usr/sbin/fuser [-c | -d | -f] [-nu] [-k | -s sig] files [ [- ] [-c | -d | -f] [-nu] [-k | -s sig] files] ...Description
The fuser utility displays the process IDs of the processes that are using the files specified as arguments.
Each process ID is followed by a letter code. These letter codes are interpreted as follows. If the process is using the file as
c Indicates that the process is using the file as its current directory.
m Indicates that the process is using a file mapped with mmap(2). See mmap(2) for details.
n Indicates that the process is holding a non-blocking mandatory lock on the file.
o Indicates that the process is using the file as an open file.
r Indicates that the process is using the file as its root directory.
t Indicates that the process is using the file as its text file.
y Indicates that the process is using the file as its controlling terminal.
Example:
Assuming your home directory is on a separate filesystem mounted at /export/home, this will show all processes using files in any manner on that file system, including those processes that aren't doing any IO but have a current working directory in that filesystem along with processes that have files memory mapped from that file system:
fuser -c /export/home
iosnoopwon't be able to completely identify processes using the filesystem in all possible ways. It will not show processes that merely have a current working directory in the file system, and it may not be able to track IO frommmap()'d files back to the actual process, as that data could potentially be from multiple processes, and the process id might get "lost" as the data passes through any cache.