iotop Command in Linux: Syntax, Options, Cheat Sheet & Practical Examples

The iotop command in Linux is used to monitor disk I/O usage by processes in real time. It helps system administrators quickly identify applications or processes that are generating heavy disk read and write activity.

Unlike tools such as iostat which show device-level statistics, iotop focuses on process-level disk I/O monitoring, making it useful for troubleshooting slow disks and diagnosing performance bottlenecks.

Quick iotop Command Cheat Sheet

What is iotop in Linux

The iotop command in Linux is a monitoring utility used to track disk input/output usage by processes and threads in real time. It helps administrators identify which processes are generating heavy disk activity and consuming storage bandwidth.

The tool works similarly to the top command but focuses specifically on disk I/O statistics, making it useful for diagnosing storage performance issues and detecting processes responsible for high disk usage.

What the iotop command does

The iotop command monitors disk read and write operations performed by running processes. It displays a continuously updating list of processes and threads that are performing disk I/O operations.

Using iotop, administrators can:

• Identify processes causing high disk activity
• Monitor read and write bandwidth per process
• Detect applications slowing down the storage subsystem
• Troubleshoot disk performance bottlenecks

The command retrieves statistics directly from the Linux kernel, which allows it to display accurate real-time information about disk usage.

Why iotop is useful for disk IO monitoring

Disk I/O bottlenecks can significantly slow down applications, databases, and system services. The iotop tool helps administrators quickly determine which processes are responsible for heavy disk usage.

Some common use cases include:

• Diagnosing slow server performance
• Identifying backup or logging processes consuming disk bandwidth
• Monitoring database disk activity
• Detecting unexpected disk usage spikes

Because it displays I/O usage per process, iotop provides insights that device-level tools such as iostat cannot easily show.

Difference between iotop and top command

The iotop command is conceptually similar to the top utility but focuses on disk I/O activity instead of CPU or memory usage.

While top helps identify CPU-heavy processes, iotop helps identify processes that are generating heavy disk read and write activity.

Install iotop in Linux

The iotop command may not be installed by default on all Linux distributions. It can be installed easily using the system package manager.

Install iotop on Ubuntu and Debian

On Debian-based distributions such as Ubuntu, Debian, and Linux Mint, install iotop using the following command:

sudo apt update
sudo apt install iotop

Install iotop on RHEL, CentOS, Rocky Linux

On Red Hat-based distributions such as RHEL, CentOS, AlmaLinux, Rocky Linux, and Fedora, install iotop using:

sudo yum install iotop

For newer distributions using dnf, run:

sudo dnf install iotop

Verify iotop installation

After installation, verify that the command is available by checking its version.

iotop --version

You can also confirm the binary location using:

which iotop

If the installation was successful, the system will display the path to the iotop executable.

Basic Syntax of iotop Command

The iotop command supports several options that allow administrators to monitor disk I/O activity in different ways.

General iotop command syntax

The basic syntax of the command is:

iotop [options]

Most commonly, the command is executed with sudo because it requires elevated privileges to access kernel disk statistics.

Example:

sudo iotop

Understanding iotop command options

The iotop command provides multiple options to filter and customize the output.

These options help customize how disk activity is displayed.

Running iotop with root privileges

The iotop command must usually be executed with root privileges because it reads kernel-level statistics.

Example:

sudo iotop

Without sufficient permissions, the command may display an error indicating that it cannot access disk I/O statistics.

Monitor Disk IO Usage in Real Time

One of the most common uses of iotop is monitoring disk activity in real time to identify processes generating heavy disk traffic.

Display disk IO usage of all processes

To start monitoring disk I/O activity interactively, run:

sudo iotop

This command displays a dynamic interface that updates continuously and lists processes performing disk operations.

Example columns include:

• PID – process identifier
• USER – process owner
• DISK READ – read bandwidth used by the process
• DISK WRITE – write bandwidth used by the process
• IO – percentage of time spent waiting for disk operations

Monitor IO activity continuously

The iotop interface refreshes automatically and continuously shows disk I/O activity as processes perform read and write operations.

Administrators can observe:

• which processes generate heavy disk traffic
• how disk bandwidth is distributed among applications
• how disk usage changes during system workloads

To stop monitoring, press:

q

Understand interactive iotop interface

The interactive interface of iotop provides real-time disk statistics similar to system monitoring tools like top.

The top section displays:

• total disk read bandwidth
• total disk write bandwidth
• actual disk read/write usage

Below that, each line represents a process or thread performing disk operations. This allows administrators to quickly identify applications responsible for disk I/O spikes.

Display Processes Using Disk IO

One of the most useful capabilities of the iotop command is identifying which processes are actively performing disk input/output operations. This helps administrators quickly detect applications responsible for high disk usage.

Show processes actively performing IO

By default, iotop shows all processes and threads, including those that are idle. To display only the processes that are actually performing disk I/O, use the -o option.

sudo iotop -o

This filters the output and displays only processes that are currently reading from or writing to disk.

Display IO usage per process

To view the disk read and write bandwidth used by each process, run:

sudo iotop

Example output columns include:

• PID – Process ID
• USER – User running the process
• DISK READ – Amount of data read from disk
• DISK WRITE – Amount of data written to disk
• IO – Percentage of time the process waits for disk operations

This helps administrators monitor how disk bandwidth is distributed across processes.

Identify processes causing heavy disk usage

When a system experiences high disk activity, iotop can help identify the processes responsible.

Look for processes with:

• High DISK READ or DISK WRITE values
• High IO percentage
• Continuous disk activity

These indicators often reveal applications such as databases, backups, or logging services that generate heavy disk I/O.

Monitor Specific Processes

Sometimes administrators need to monitor disk I/O generated by a specific process rather than all running processes.

Monitor disk IO for a specific PID

The -p option allows monitoring disk activity for a particular process ID.

sudo iotop -p PID

Example:

sudo iotop -p 2345

This command displays disk I/O statistics only for the specified process.

Monitor IO usage for multiple processes

You can also monitor multiple processes simultaneously by specifying several process IDs.

sudo iotop -p 2345 -p 3012

This is useful when tracking disk activity generated by multiple related services.

Identify IO activity from long running processes

Long-running processes such as databases, backup services, and file indexing systems often generate continuous disk I/O.

Using iotop helps monitor how these processes interact with the storage subsystem and whether they are responsible for high disk load.

Monitor Disk IO by User

The iotop command can also filter disk I/O activity by user, which is useful in multi-user environments.

Display IO usage by specific user

To display disk I/O generated by a specific user, use the -u option followed by the username.

sudo iotop -u username

Example:

sudo iotop -u mysql

This command shows disk activity generated only by the specified user.

Monitor IO generated by system users

Many system services run under dedicated users such as:

• mysql
• postgres
• www-data
• nginx

Monitoring these users helps identify which services are generating disk activity.

Identify heavy IO activity from applications

By filtering output by user, administrators can quickly determine whether a specific application or service is responsible for heavy disk usage.

This is especially useful for diagnosing issues in shared hosting environments or multi-tenant servers.

Monitor IO in Batch Mode

The iotop command normally runs in an interactive interface. However, it can also be executed in batch mode, which is useful for automation and logging.

Run iotop in non interactive mode

To run iotop in batch mode, use the -b option.

sudo iotop -b

In batch mode, the output is printed line by line instead of displaying an interactive interface.

Capture IO statistics for automation

Batch mode is commonly used in scripts that monitor system performance.

Example:

sudo iotop -b -n 5

This command runs iotop in batch mode and captures five iterations of disk statistics.

Log IO activity to a file

You can redirect the output of iotop to a file for later analysis.

sudo iotop -b -n 10 > io_log.txt

This logs disk activity for 10 iterations and saves the output to a file.

Analyze Disk IO Performance

The iotop tool is very helpful for diagnosing disk performance issues and identifying applications that generate heavy disk activity.

Identify processes causing high disk usage

When a system experiences slow performance due to disk activity, iotop can reveal which processes are consuming the most disk bandwidth.

Run:

sudo iotop

Look for processes with:

• high disk read/write bandwidth
• high I/O percentage
• continuous disk operations

Detect disk bottlenecks using iotop

A disk bottleneck may occur when too many processes compete for disk access.

Indicators of a bottleneck include:

• multiple processes with heavy disk usage
• consistently high disk activity
• slow application response times

Monitoring disk activity using iotop helps administrators determine whether the issue is caused by storage performance.

Monitor IO during heavy workloads

iotop is often used to monitor disk usage during:

• system backups
• database queries
• large file transfers
• log processing
• data indexing

Observing disk activity during these workloads helps administrators understand how system resources are being utilized.

Sorting and Filtering iotop Output

The iotop tool provides several ways to sort and filter disk I/O activity so administrators can quickly identify the most active processes. Sorting helps highlight processes generating the most disk reads or writes, while filtering allows displaying only relevant processes.

Sort processes by disk read

Inside the interactive iotop interface, you can sort processes based on disk read activity using the keyboard arrow keys.

1. Start the tool:

sudo iotop

2. Use the left or right arrow keys to change the sorting column.

Sorting by the DISK READ column helps identify processes performing heavy disk read operations.

Sort processes by disk write

Similarly, you can sort by the DISK WRITE column to identify processes generating large write operations.

Launch iotop and navigate to the DISK WRITE column using arrow keys.

This helps detect processes such as:

• log writers
• database engines
• backup jobs
• file synchronization tools

Change sorting order dynamically

To reverse the sorting order in the interactive interface, press:

r

This toggles between ascending and descending sorting so you can easily locate processes with the highest or lowest disk activity.

Filter processes performing IO only

To display only processes that are actively performing disk I/O operations, use the -o option.

sudo iotop -o

This removes idle processes from the list and focuses only on processes generating disk activity.

Control Output Frequency

By default, iotop refreshes the display frequently. However, administrators can control how often the statistics update using specific options.

Set update interval using delay option

The -d option allows specifying the delay between output updates.

sudo iotop -d 5

This command refreshes disk statistics every 5 seconds instead of the default interval.

Capture IO statistics for limited iterations

To limit the number of output updates, use the -n option.

sudo iotop -n 5

This command updates the display five times before exiting.

Monitor IO usage at custom intervals

You can combine both options to capture disk activity at custom intervals.

sudo iotop -d 3 -n 10

This command captures 10 updates with a 3-second interval, which is useful for short-term monitoring or troubleshooting disk activity.

Monitor Accumulated IO Usage

The iotop command normally displays current disk bandwidth usage. However, administrators may want to see the total accumulated I/O usage since the command started.

Display accumulated IO statistics

To display accumulated disk I/O instead of real-time bandwidth, use the -a option.

sudo iotop -a

This shows the total amount of disk data read and written by each process since iotop started.

Compare accumulated IO vs bandwidth

The difference between these modes:

Bandwidth mode is useful for real-time monitoring, while accumulated mode helps analyze long-running processes.

Use accumulated IO for long running processes

Accumulated statistics are useful when monitoring:

• database servers
• backup processes
• file synchronization jobs
• log aggregation services

These workloads generate disk activity over extended periods, and accumulated I/O helps determine which processes consume the most storage bandwidth.

Understand iotop Output Fields

Explain DISK READ and DISK WRITE columns

These columns display the amount of disk bandwidth consumed by each process.

Higher values indicate processes performing heavy disk read or write operations.

Understand IO and SWAPIN percentages

The iotop output also includes percentage-based indicators.

High IO percentages may indicate disk bottlenecks, while high SWAPIN values suggest memory pressure leading to swap usage.

Interpret process priority and IO usage

The PRIO column represents the I/O priority assigned to the process.

Typical values include:

• be – best effort I/O scheduling
• rt – real-time I/O priority
• idle – lowest priority

Processes with higher priority may receive disk access earlier than lower priority processes.

Reduce Output Noise

On busy systems, iotop may display many processes, making it difficult to identify relevant disk activity. Several options help reduce unnecessary output.

Hide idle processes

The most common way to reduce output clutter is to show only processes performing disk I/O.

sudo iotop -o

This hides processes that are not actively performing disk operations.

Display only active IO operations

Combining options can further simplify the output.

sudo iotop -o -P

This displays only active processes performing disk I/O and hides thread-level details.

Simplify output using quiet mode

The -q option reduces header information in the output.

sudo iotop -q

This makes the output cleaner and easier to parse, especially when capturing output in scripts or logs.

iotop vs Other Linux Disk Monitoring Tools

Linux provides multiple tools for monitoring system and disk performance. While iotop focuses on process-level disk I/O usage, other tools provide device-level statistics or broader system monitoring capabilities. Understanding how these tools differ helps administrators choose the right tool when diagnosing performance issues.

iotop vs iostat

The iotop and iostat commands are both used to analyze disk activity, but they focus on different levels of monitoring.

Use iotop when you want to identify which processes are generating disk I/O, and use iostat when analyzing overall disk performance metrics such as throughput, latency, and device utilization.

iotop vs dstat

The dstat command is a versatile system monitoring tool that combines features from several utilities such as vmstat, iostat, and netstat.

Use iotop when investigating which process is consuming disk bandwidth, and use dstat when monitoring multiple system resources simultaneously, including CPU, disk, memory, and network activity.

iotop vs vmstat

The vmstat command provides statistics related to CPU, memory, processes, paging, and system performance.

Use iotop to identify processes responsible for disk I/O activity, while vmstat is better suited for analyzing overall system performance, including CPU and memory usage.

When to use each tool

Each monitoring tool serves a different purpose when troubleshooting system performance.

In many cases, administrators use multiple tools together to obtain a complete view of system performance.

Summary

The iotop command is a powerful Linux utility that helps administrators monitor disk input/output usage by processes in real time. It provides detailed insights into which applications are generating disk read and write operations, making it extremely useful for diagnosing storage performance issues.

By using various options such as filtering processes, monitoring specific users or PIDs, running in batch mode, and analyzing accumulated I/O usage, administrators can efficiently identify disk bottlenecks and troubleshoot high disk activity on Linux systems.

When combined with other monitoring tools like iostat, dstat, and vmstat, iotop becomes an essential component of the Linux performance monitoring toolkit.

Official Documentation

For a complete list of options and detailed usage information, refer to the official manual page for the iotop command.

iotop manual page