Forum OpenACS Q&A: tracking down disk io

iostat shows one of my disks writing 20-80kBps pretty
consistently.  This is the disk that has the root fs; PG and
nsd are on other disks, so all that I'd expect to be writing are
syslog and the odd mail message.  ps doesn't show anything
unusual, and df doesn't show disk usage growing appreciably so
whatever is responsible is overwriting  rather than appending.

Is there an iostat-like utility but per process, or some other way of
figuring out what is going on?

I should have mentioned that swap is on a separate partition and shows low to zero activity.

here's what I'm running lsof through:

sed 's/            / 0 /g' | awk '($4 ~ /u$/ || $4 ~ /w$/) && $7 > 0'

the awk says that I only want files open for writing or update, and it has to be an actual file. the sed just puts in a filesize of zero where lsof leaves it blank, which would screw up the awk field count.

grepping away non-root filesystems from this leaves me with imapd and syslogd, as I expected. I killed imapd and I still see the activity. Bleh. Didn't bother killing syslogd b/c as I said, if logs were growing at 50kBps I'd notice. :)