How to use iotop to find processes freezing your disk

Why does your Linux server suddenly slow down?

When server latency spikes and applications stop responding, the immediate temptation is to blame a lack of RAM or excessive CPU usage. In practice, the real villain is often the storage subsystem. Traditional spinning hard drives and even high-speed solid-state drives struggle when multiple applications demand simultaneous read and write operations. To understand what is happening under the hood, system administrators need to look beyond the basics and examine the individual behavior of every single program running on the machine.

If you have ever tried traditional commands and noticed they only show average controller usage without pointing fingers at specific culprits, a surgical alternative exists. Much like we explained when covering how to use htop to find heavy processes on Linux, the command line offers dedicated utilities tailored for every system resource. When the issue involves chronic file access lag, iotop is the indispensable tool that reveals precisely which program is suffocating your storage.

What is iotop and how does it work in practice

The iotop utility is a command-line tool for Linux operating systems that monitors input and output disk activity in real time. Think of it as the classic system task manager, but focused exclusively on how much data each program is reading from or writing to the disk. It hooks directly into the kernel—the core component of the operating system responsible for managing hardware—to extract detailed metrics regarding the data traffic flowing through storage controllers.

In practice, running this tool gives you a dynamic table updated second by second. Each row represents an active process, showing its numerical identifier, owning user, read rate in kilobytes or megabytes per second, write rate, and the percentage of time that process spent waiting for the disk to respond. This granular visibility is what separates a frustrating guessing game from a fast, accurate diagnosis in production environments.

How to install and run iotop on your server

On many modern Linux distributions, iotop does not come pre-installed, but it can be added in seconds using the system package manager. Because the tool requires deep access to kernel internals to gather hardware statistics, running it requires administrative privileges. Furthermore, older or overburdened hardware can also lag due to physical wear, making it wise to review how to diagnose locked I/O on Linux to rule out bus freezes.

To get the tool running on your server environment, execute the following commands in the terminal according to your distribution:

# On Debian or Ubuntu based systems sudo apt update && sudo apt install iotop  # On Red Hat or Fedora based systems sudo dnf install iotop  # Running the tool with superuser privileges sudo iotop

Interpreting columns and metrics on the screen

As soon as the text-based interface loads, you are greeted with several columns that might look confusing at first glance. The first column displays the PID, which is the unique identification number of each process. Subsequent columns show the user who started the task, execution priority, and further right, the fundamental real-time read and write rates. The write column is usually the most heavily monitored, as runaway logging processes or misconfigured databases frequently saturate storage write capacity.

Another vital indicator is the disk swap and wait percentage, frequently labeled as IO%. When this metric is extremely high for a given process, it means the CPU is idle, merely waiting for the disk to finish delivering or saving requested data. This creates a bottleneck known as I/O wait, where the server appears frozen not because the processor is weak, but because the disk cannot keep up with incoming requests.

Filtering active processes and optimizing analysis

On a large enterprise server with hundreds of tasks running simultaneously, the iotop screen can become cluttered with dozens of lines showing zero activity. To make reading easier and focus on what truly matters, the utility allows you to apply smart filters. Pressing the 'o' key on your keyboard configures the interface to display only processes that are actively performing read or write operations at that exact moment, hiding the rest of the system's process tree.

Another useful feature is the accumulated data mode, enabled via startup parameters. When you run the tool with accumulation enabled, it tallies the total volume of data transferred by each process since the command was launched, rather than showing only the instantaneous rate. This helps catch tasks that write data sporadically but accumulate massive volumes over hours of continuous operation.

Step-by-step to track and terminate an abusive process

When analysis reveals a rogue process hogging all storage controller bandwidth and locking up other applications, intervention must be fast and precise. Following a logical sequence of verification and action prevents you from accidentally killing a critical service and guarantees operating system stability. To explore these architectural concepts further in production, see our related technical analysis on How to test open SMD inductors on board with multimeter.

1. Open the terminal with administrative access and start monitoring while filtering only active operations:

   sudo iotop -o

2. Observe the table for a few seconds to identify the identification number of the problematic process in the PID column.
3. Terminate the task safely or forcefully using the termination command followed by the collected number:

   sudo kill -15 <PID>

Conclusion and best practices to prevent storage bottlenecks

Proactive monitoring of the storage subsystem is one of the most valuable skills for any technology professional managing production servers. Knowing how to use specialized utilities turns complex incident resolution into a methodical process, eliminating guesswork when system latency spikes. Integrating this verification routine with alerting and auditing tools ensures storage saturation problems are identified and resolved before impacting end-user experience.

Maintaining infrastructure health requires constant attention to detail and the proper use of native ecosystem tools. By mastering process tracking with high disk usage, you gain the autonomy to diagnose performance flaws in minutes, keeping services running with maximum efficiency and stability regardless of application workloads.