How to Monitor Top Filesystem Reads and Writes in Linux Using filetop

When storage I/O performance degrades on a Linux server, identifying which files and processes are consuming disk throughput is critical for rapid troubleshooting. Standard system utilities such as top and iotop measure block device activity and thread sleep states, but they cannot tell you which specific files on disk are absorbing reads and writes. Traditional monitoring tools that poll /proc introduce significant overhead and frequently miss short-lived burst I/O. The filetop tool, part of the BPF Compiler Collection (BCC), solves this visibility challenge by attaching eBPF kernel probes to internal Virtual File System (VFS) read and write routines. It provides an interactive, top-like terminal dashboard showing top file reads, writes, and byte throughput in real time. This article explains how to install BCC tools, monitor live filesystem throughput, and isolate heavy file I/O consumers in Linux using filetop.

Understanding Linux VFS Tracing with filetop

In the Linux operating system, all user-space file operations—regardless of whether they target ext4, XFS, Btrfs, NFS, or tmpfs—pass through the common Virtual File System (VFS) layer. filetop attaches lightweight eBPF probes to the entry and exit of core kernel functions including vfs_read() and vfs_write():

• Low Overhead: Because telemetry aggregation occurs entirely within kernel-space BPF maps, filetop does not copy trace data to user space until the display interval triggers, imposing negligible CPU load.
• Process Attribution: Every read and write transaction is correlated with the calling Process ID (PID), thread group, and process command name (COMM).
• Byte Counting: Tracks both operation counts (read/write system call invocations) and total volume transferred in kilobytes.
• Cached vs Uncached I/O: Unlike block-layer tools like biotop, filetop captures operations at the filesystem layer, allowing administrators to observe files being accessed heavily from the page cache as well as those hitting physical disk.

Installing BCC Tools on Debian, Ubuntu, and Enterprise Linux

Before launching filetop, verify that your distribution provides the BCC toolchain compiled against your active kernel headers. On Debian and Ubuntu systems, execute:

sudo apt update
sudo apt install bpfcc-tools linux-headers-$(uname -r)

On Red Hat Enterprise Linux, Rocky Linux, AlmaLinux, and Fedora systems, install the corresponding packages:

sudo dnf install bcc-tools kernel-devel-$(uname -r)

On Debian and Ubuntu, BCC utilities include a -bpfcc suffix (/usr/sbin/filetop-bpfcc), whereas Enterprise Linux distributions locate them in /usr/share/bcc/tools/filetop.

Monitoring Live Filesystem I/O with filetop

To begin real-time filesystem monitoring across the entire operating system, execute filetop with superuser privileges. By default, running the utility without arguments clears the terminal screen and refreshes the top I/O table every second:

sudo filetop-bpfcc

A representative terminal output displays the following performance columns:

14:45:10 loadavg: 1.12 0.85 0.62 2/412 14892

TID    COMM             READS  WRITES R_Kb    W_Kb    T FILE
4812   postgres         120    48     960     384     R base/16384/24810
3102   mysqld           42     110    336     880     R ibdata1
8921   rsync            850    0      6800    0       R backup_archive.tar.gz
2104   redis-server     0      64     0       256     R dump.rdb
1104   dockerd          14     8      112     64      R daemon.json

Understanding each reporting field ensures accurate diagnostic conclusions:

• TID / PID: The Linux thread or process identifier performing the file operation.
• COMM: The executable command name executing the I/O.
• READS / WRITES: The total number of read and write system call invocations during the sampling window.
• R_Kb / W_Kb: Total read and write throughput measured in kilobytes during the sampling interval.
• T (Type): File descriptor type—R for regular disk files, S for sockets, O for other descriptor types.
• FILE: The filename or relative path being accessed.

Customising Refresh Intervals and Sorting Metrics

By default, filetop sorts output by all system calls. To tailor telemetry collection for specific diagnostics:

1. Adjust Refresh Interval and Iterations: To refresh the display every 5 seconds for 12 iterations (spanning one minute of observation), specify the interval and count:

sudo filetop-bpfcc 5 12

2. Sort by Read Throughput (-r): When investigating read-heavy database query spikes or cold cache scans, sort the display by read volume:

sudo filetop-bpfcc -s r

3. Sort by Write Throughput (-w): When storage writes saturate NVMe write caches or trigger disk flushing bottlenecks, sort by write volume:

sudo filetop-bpfcc -s w

4. Preserve Screen History (-C): By default, filetop clears the terminal on each refresh. Pass the -C flag to prevent screen clearing, printing sequential snapshots suitable for redirecting into logging scripts:

sudo filetop-bpfcc -C 10 > /var/log/file_io_audit.log

Filtering by Specific Process ID (PID)

To audit file transactions generated by a single mission-critical daemon—such as an Nginx web server or MongoDB instance—isolate the process using the -p parameter:

sudo filetop-bpfcc -p 4812

This filters out all unassociated operating system file accesses, focusing exclusively on files touched by the target process.

By leveraging filetop, Linux system administrators and site reliability engineers can instantly identify rogue batch scripts, runaway logging daemons, and database hot-spots, isolating storage bottlenecks at the file level with minimal system impact.