How do I tell what my HDD's are doing?

[CHIZ]

I am having a problem trying to determine what my drives are doing sometimes. My NAS is near my bed so if the drives are spinning I can hear them. It's not annoying or anything, but sometimes I can hear the drives spinning when I would think they shouldn't be. Here is what I mean by that.

As a preface, I'm not very knowledgeable with FreeNAS, I know just enough to follow tutorials and youtube videos to get everything setup how I want.

I have 3 jails running. One for a Mumur server (Mumble), one for Transmission, and one for Plex. The Mumble server is used just as a backup and really, no one is on it. I don't leave Transmission torrents going at night, so that shouldn't be the cause. It also happens when I'm not watching anything on Plex.

Now I know the NAS is not limited to those 3 jails, but outside of a snapshot task, I don't know what it could be doing and I'm wondering Is there a way to tell what is writing/reading from the drives?

I have included a screenshot of the Disks screen where you can see writing is happening to the drive but my goal is to find out what.

I have snapshots set to run weekly on Wednesdays for the jails but the activity I've described above happens outside of that window.

 

[danb35]

It's entirely normal. System logs, reporting data, Samba information, etc. are all being stored to your pool on a regular basis.

 

[jgreco]

If it is non-local accesses, you can use "tcpdump" to tell what is going on. There isn't a good way to easily identify what is going on locally. However, do note that Plex and other daemons may be doing maintenance and updating data even when you don't necessarily expect them to be.

 

[CHIZ]

If it is non-local accesses, you can use "tcpdump" to tell what is going on. There isn't a good way to easily identify what is going on locally. However, do note that Plex and other daemons may be doing maintenance and updating data even when you don't necessarily expect them to be.

Thank you, this is helpful because my main concern is security. It's too bad there is not an easier way to tell what is writing to the disks.

For anyone coming across this thread later, you can get the "tcpdump" command to stop filling up your terminal with Ctrl+Z

 

[Bidule0hm]

Use Ctrl + C if you want to quit a command, Ctrl + Z just puts it in the background and it's still running.

 

[DrKK]

It's too bad there is not an easier way to tell what is writing to the disks.

drop to shell, type

Code:

top -mio

Also, if someone is connected to your box, you'll see if with

Code:

sockstat -4

, which will show all listening, and all active network sockets over ipv4. There's pretty much no way to be on a FreeNAS appliance and not have your connection show up here. Sockstat should show you 7 columns, they are, respectively:

1. The system user id that owns the socket
2. The name of the process (program) that has the socket associated to it
3. The process id holding the socket
4. FD (don't worry about it, doesnt matter)
5. The type of socket (probably should be tcp4 or udp4)
6. The address of computer the socket is talking *to* (i.e., should be either 127.0.0.1, or the IP address of your FreeNAS or a jail)
7. The address of computer on the remote side, it will show *:* if it's just listening for anything at this point.

Anyway, so if you want to know if anyone is logged into anything on your FreeNAS, you can check your sockets for unusual activity.

But the odds of that are 0.000004812%.

 

[jgreco]

Thank you, this is helpful because my main concern is security. It's too bad there is not an easier way to tell what is writing to the disks.

It's a NAS, so it is probably somewhat crazy to try to figure that out. But if you really wanted, you might be able to build a FreeNAS version with a custom kernel that enabled FreeBSD's AUDIT capabilities.

 

[Deleted47050]

It's entirely normal. System logs, reporting data, Samba information, etc. are all being stored to your pool on a regular basis.

That would be my first guess as well. If this happens pretty often it might simply be data being written to the System Dataset.

 

[cyberjock]

If you change the logging... say change Samba to the debug level logging you'll have MASSIVE amounts of writes. We're talking potentially 50MB/sec+ just for Samba logs. So be careful what you ask for with regards to logging. ;)