When a Linux server suddenly becomes sluggish, the first instinct is to run the top or htop commands to check if a rogue process is consuming 100% of the CPU or RAM. However, there is a third, “hidden” bottleneck that often brings servers to a crawl: Disk Input/Output (I/O).
If your hard drive or SSD is constantly reading or writing data at its maximum physical speed—perhaps due to a massive database query, an uncontrolled log file, or a heavy backup process—the entire system will freeze while waiting for the disk to catch up. Standard CPU monitors do not show this clearly. To identify exactly which program is thrashing your storage drive, you need the iotop command.
What is iotop?
iotop is a specialized, interactive command-line utility modeled after the famous top command. Instead of showing CPU cycles, it ranks every active process based on how much data it is currently reading from or writing to the disk in real-time.
How to Install iotop
Unlike top, iotop is not usually installed by default on minimal server distributions because it requires Python.
On Debian and Ubuntu-based systems, install it using the APT package manager:
sudo apt update && sudo apt install iotop
On RedHat, CentOS, AlmaLinux, or Fedora systems, use DNF or YUM:
sudo dnf install iotop
How to Read the iotop Interface
Because monitoring physical disk access requires deep kernel-level privileges, you must run iotop as the root user or via sudo.
sudo iotop
When the interface loads, it updates every second. Look at the top two lines first:
- Total DISK READ: The absolute total speed (e.g., 50.00 M/s) of all data being pulled from the drive.
- Total DISK WRITE: The absolute total speed of all data being saved to the drive.
Below that summary, you will see a constantly shifting table. The most important columns are:
- DISK READ and DISK WRITE: The exact speed (in K/s or M/s) for each specific process.
- IO>: The percentage of time the process spent waiting for the disk. If this number is near 99%, this process is severely bottlenecked by your storage speed.
- COMMAND: The name of the application causing the activity (e.g.,
mysqld,rsync, orsystemd-journald).
Filtering the Noise (The -o Flag)
By default, iotop shows hundreds of idle background processes that are doing absolutely nothing, making it difficult to spot the culprit.
The most useful way to run the tool is with the “only” flag (-o). This completely hides any process that is currently idle, showing you only the processes actively performing disk I/O right at this exact second.
sudo iotop -o
If you have already launched the interface without the flag, you can press the o key on your keyboard to toggle this filter on and off dynamically.
Running in Batch Mode for Logging
If your server experiences disk spikes at random times during the night, you cannot sit and watch the interactive screen for hours. You can run iotop in “batch” mode (-b), which prints the output as text lines instead of a live interface, allowing you to save the data to a log file for later analysis.
sudo iotop -b -o -t -d 5 > /var/log/iotop_monitor.log
This command runs in batch mode (-b), shows only active processes (-o), includes a timestamp (-t), and checks the disk every 5 seconds (-d 5), writing the evidence directly to a log file.