How-to: Monitoring disk access in Mac OS X
Problem description: An external disk is constantly spinning, never spinning down to sleep. This occurs even without any visible applications running.
If you are still stuck with your problem you can try to monitor low-level disk-operations using some of the utilities included in recent versions of Mac OS 10.x.
1. Use the fs_usage command to list file-system activity.
See to it that all unnecessary applications are closed before running this tool since it will produce alot of info.
a) Open a terminal window
b) Type: sudo fs_usage -w -f ”filesys” > ./fs_usage.log
c) Wait for a number of seconds while your disk is making sounds (hopefully working and not due to mechanical error), then press Ctrl + c to end the logging-session.
d) Type: nano fs_usage.log to view the log (or open it in your fav. texteditor)
e) There are just a couple of Columns which are interesting to us right now. The second column which shows us the action taken (i.e. open, stat, getattrlist, access_extended and so on), the fourth column containing path-data (i.e. /Volumes/My Drive, /Users/username/directory, /Applications/Appname.app) and the sixth column entailing which process is responsible for the action.
This may give you a hint what is causing your disk activity to be at a constant.
Try finding processes which use your disk and start killing those processes one by one.
2) Identify and kill processes to find the culprit
2 a) In your terminal window, type: sudo ps aux | grep [A]pplication
Example: sudo ps aux | grep [F]inder
jonathanjames 489 0.0 1.6 2925792 65644 ?? S Tue05PM 1:30.20 /System/Library/CoreServices/Finder.app/Contents/MacOS/Finder
The second value ”489″ is the PID (process-ID) which is our handle to the process.
2 b) Type: sudo kill PID
2 c) Check that the process got killed, if not, it is probably involved in some kernel or I/O-activity. Type: sudo ps aux | grep [F]inder – which should return an empty result meaning that the process is killed.
Did the disk-activity stop? Then we might have found the culprit. If not, it could be caused by a system-process, kernel-involved process or a process currently performing I/O-operations (which prevents kill from killing the process). In this case, see to it that you keep the amount of open applications to an absolute minimum (preferably no open applications at all) and perform the following kill-statement: sudo kill -9 PID
This should kill off any running process, even if it is currently doing I/O, certain kernel operations (at least storage-related ones).
This technique is enough most of the time, you could check out a service called diskarbitrationd (launchd is used to launch this in Snow Leopard, use the launchctl command). If you supply diskarbitrationd with a debug-flag you can get all disk-access logged to /var/log/diskarbitrationd.log.




