here's what I'm running lsof through:
sed 's/ / 0 /g' | awk '($4 ~ /u$/ || $4 ~ /w$/) && $7 > 0'
the awk says that I only want files open for writing or update, and it has to be an actual file. the sed just puts in a filesize of zero where lsof leaves it blank, which would screw up the awk field count.
grepping away non-root filesystems from this leaves me with imapd and syslogd, as I expected. I killed imapd and I still see the activity. Bleh. Didn't bother killing syslogd b/c as I said, if logs were growing at 50kBps I'd notice. :)
