https://github.com/draios/sysdig/wiki/Sysdig%20Examples#disk

sysdig is a great solution now.

Some usage cases include (their wiki has some exceptionally interesting examples):

For Disk I/O

• See the top processes in terms of disk bandwidth usage

  sysdig -c topprocs_file

• List the processes that are using a high number of files

  sysdig -c fdcount_by proc.name "fd.type=file"

• See the top files in terms of read+write bytes

  sysdig -c topfiles_bytes

• Print the top files that apache has been reading from or writing to

  sysdig -c topfiles_bytes proc.name=httpd

• Basic opensnoop: snoop file opens as they occur

  sysdig -p "%12user.name %6proc.pid %12proc.name %3fd.num %fd.typechar %fd.name" evt.type=open

• See the top directories in terms of R+W disk activity

  sysdig -c fdbytes_by fd.directory "fd.type=file"

• See the top files in terms of R+W disk activity in the /tmp directory

  sysdig -c fdbytes_by fd.filename "fd.directory=/tmp/"

• Observe the I/O activity on all the files named ‘passwd‘

  sysdig -A -c echo_fds "fd.filename=passwd"

• Display I/O activity by FD type

  sysdig -c fdbytes_by fd.type

sysdig