cheatsheet

iotop Command in Linux: Syntax, Options & Practical Examples (Ubuntu)

iotop shows real-time disk read and write bandwidth per process and thread on Linux. It reads kernel I/O accounting so you can see which application is saturating storage during slowdowns.

Published

Updated

Read time 9 min read

Reviewed byDeepak Prasad

iotop Command in Linux: Syntax, Options & Practical Examples (Ubuntu)
About iotop shows real-time disk read and write bandwidth per process and thread on Linux. It reads kernel I/O accounting so you can see which application is saturating storage during slowdowns.
Tested on Ubuntu 25.04 (Plucky Puffin); iotop 0.6; kernel 7.0.0-27-generic
Package iotop (apt/deb) · iotop (dnf/rpm)
Man page iotop(8)
Privilege root / sudo
Distros

Debian and Ubuntu (iotop package); most admin guides install from distro repos.

Device-level stats: iostat (sysstat). Per-process without iotop: harder — iotop is the usual tool.

iotop — quick reference

Display modes

Control what rows appear and whether bandwidth or totals are shown.

When to use Command
Interactive real-time view (default) sudo iotop
Show only threads/processes doing I/O sudo iotop -o
Show processes only — hide individual threads sudo iotop -P
Show accumulated I/O since start instead of bandwidth sudo iotop -a
Display bandwidth in kilobytes sudo iotop -k

Batch and scripting

Non-interactive output for logs and cron jobs.

When to use Command
Batch mode — print lines instead of full-screen UI sudo iotop -b
Limit to N screen updates then exit sudo iotop -b -n 5
Wait SEC seconds between updates sudo iotop -b -d 5
Add timestamp on each line (implies batch) sudo iotop -t
Quieter header (implies batch) sudo iotop -q
Batch snapshot of active I/O only sudo iotop -b -o -q -n 3

Filtering

When to use Command
Monitor one process ID sudo iotop -p PID
Monitor several PIDs sudo iotop -p PID1 -p PID2
Monitor one user's processes sudo iotop -u USER

Help and version

When to use Command
Show usage iotop -h
Show iotop version iotop --version

Interactive keys (default TUI): left/right arrows change sort column, o toggles only-I/O, p toggles processes-only, a toggles accumulated mode, q quits.

iotop — command syntax

Synopsis from iotop --help on Ubuntu 25.04 (iotop 0.6):

text 
iotop [OPTIONS]

iotop reads per-task block I/O statistics from the kernel. It must run as root (or via sudo) on most systems because process-level I/O counters are restricted.

iotop — command examples

Essential Start interactive iotop

Open the live view to see which processes read or write disk right now — similar to top, but for block I/O.

Run the command:

bash 
sudo iotop

Sample output (first lines — values change every second):

text 
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:       0.00 B/s
    TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
    213 be/3 root        0.00 B/s    0.00 B/s ?unavailable?  [jbd2/dm-0-8]
   1472 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups

Press q to quit. Use arrow keys to sort by read or write column; press o to hide idle tasks.

Essential Show only processes doing disk I/O (-o)

On a quiet system the full list is mostly zeros. -o filters to tasks with active read or write bandwidth.

Run the command:

bash 
dd if=/dev/zero of=/tmp/iotop-demo bs=1M count=20 conv=fdatasync
sudo iotop -b -o -n 2 -q
rm -f /tmp/iotop-demo

Sample output (during the write):

text 
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:       31.25 K/s
    TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
    213 be/3 root        0.00 B/s   19.53 K/s ?unavailable?  [jbd2/dm-0-8]
    268 be/3 root        0.00 B/s   11.72 K/s ?unavailable?  systemd-journald

The dd command itself may appear only while it runs; journal and jbd2 threads often show metadata writes.

Essential Batch mode for scripts (-b -n)

Batch mode prints plain text suitable for logs — no curses UI.

Run the command:

bash 
sudo iotop -b -n 2 -q | head -12

Sample output:

text 
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:         0.00 B/s
    TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
      1 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  init splash
      2 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  [kthreadd]
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:         0.00 B/s

-n 2 collects two intervals then exits — useful in cron or monitoring wrappers.

Common Monitor one process (-p)

After you know a suspicious PID from top or ps, watch only its disk activity.

Run the command:

bash 
sudo iotop -b -q -n 1 -p 1

Sample output:

text 
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:       0.00 B/s
    TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
      1 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  init splash

Replace 1 with your database or backup PID during a workload spike.

Common Filter by user (-u)

On shared hosts, see disk I/O from one account — for example mysql or www-data.

Run the command:

bash 
sudo iotop -b -q -n 1 -u root | head -8

Sample output:

text 
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:       0.00 B/s
    TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
      1 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  init splash
      2 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  [kthreadd]

Combine with -o when you only want that user's tasks that are actively doing I/O.

Common Accumulated totals (-a)

Default mode shows bandwidth per interval. -a shows total bytes read and written since iotop started — better for long-running jobs.

Run the command:

bash 
sudo iotop -b -q -n 1 -a | head -8

Sample output:

text 
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:       0.00 B/s
    TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
      1 be/4 root          0.00 B      0.00 B ?unavailable?  init splash
      2 be/4 root          0.00 B      0.00 B ?unavailable?  [kthreadd]

Column headers stay per-second for totals at the top; per-row values are cumulative with -a.

Common Hide threads — processes only (-P)

Thread-heavy apps (Java, some databases) flood the screen. -P rolls up to one line per process.

Run the command:

bash 
sudo iotop -b -q -n 1 -P | head -8

Sample output:

text 
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:       0.00 B/s
    PID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
      1 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  init splash
      2 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  [kthreadd]

The left column shows PID instead of TID when -P is set.

Advanced Log with timestamps (-t)

-t prefixes each line with time — good when appending to a log file during an incident.

Run the command:

bash 
sudo iotop -b -q -t -n 1 -o | head -6

Sample output:

text 
15:35:36 Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
15:35:36 Current DISK READ:       0.00 B/s | Current DISK WRITE:       0.00 B/s
    TIME    TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND

Redirect full output: sudo iotop -b -t -n 60 -d 5 >> /var/log/iotop-snap.log.

Advanced Custom refresh interval (-d)

Slow the sample rate when you want fewer, wider snapshots — for example every 5 seconds for ten samples.

Run the command:

bash 
sudo iotop -b -q -d 2 -n 2 | head -6

Sample output:

text 
Total DISK READ:         0.00 B/s | Total DISK WRITE:         0.00 B/s
Current DISK READ:       0.00 B/s | Current DISK WRITE:       0.00 B/s
    TID  PRIO  USER     DISK READ  DISK WRITE  SWAPIN      IO    COMMAND
      1 be/4 root        0.00 B/s    0.00 B/s ?unavailable?  init splash

Default delay is 1 second when -d is omitted.

iotop — when to use / when not

Use iotop when Use something else when
  • The disk LED is busy but CPU is idle and you need the process name
  • A database, backup, or indexer might be flooding the disk
  • You want a top-like live view or batch log of per-process I/O
  • You already have a PID and need to confirm it is I/O bound
  • You need device-level throughput, latency, and %util → iostat
  • You care about CPU, memory, and run queue — not disk by process → vmstat or top
  • You need historical trends from sysstat archives → sar command cheat sheet
  • You cannot use root — iotop will not show other users' I/O counters

iotop vs iostat

iotop iostat
Level Per process / thread Per block device
Real-time TUI Yes No (text intervals)
Needs root Yes No
Shows %util, await No Yes (-x)
Best for "Who is writing?" "Is the disk saturated?"

Run iostat -x to see whether the disk is the bottleneck; run iotop to name the process once you know I/O is high.

Command One line
iotop Per-process disk bandwidth (this page)
pidstat Per-process CPU and I/O from sysstat

Browse the full index in our Linux commands reference.

iotop — interview corner

What is iotop used for?

iotop displays disk read and write bandwidth per process in real time, using kernel task I/O accounting. It answers which application is hitting storage when the system feels slow but CPU looks fine.

bash 
sudo iotop -o

A strong answer is:

"iotop is top for disk I/O — per-process read/write rates. I use -o to hide idle tasks and need root because of kernel accounting permissions."

iotop vs iostat?

iostat reports device metrics — tps, throughput, await, %util. iotop attributes traffic to processes. They complement each other on one incident.

A strong answer is:

"iostat tells me if sda is saturated; iotop tells me which PID is driving it. I start with iostat -x, then iotop -o."

What do IO and SWAPIN columns mean?

IO is the percentage of time the task waited for I/O in the last interval. SWAPIN is time spent swapping in pages — high SWAPIN often means memory pressure, not just slow disks.

A strong answer is:

"IO is I/O wait for that task; SWAPIN is swap-in wait. High SWAPIN points me at memory before tuning disk."

How do you use iotop in scripts?

Batch mode (-b) prints to stdout without the interactive UI. Add -n for iteration count, -d for delay, -q for a shorter header, and -t for timestamps.

bash 
sudo iotop -b -o -n 5 -q

A strong answer is:

"I use sudo iotop -b -o -n N for cron-friendly snapshots, often with -q and -t for logs."

Why does iotop require root?

Per-task I/O counters live in kernel structures that are restricted so unprivileged users cannot spy on other tenants' I/O patterns. Hence sudo iotop on typical servers.

A strong answer is:

"Process-level I/O stats need privileges — iotop reads kernel accounting that normal users cannot access for other PIDs."

Troubleshooting

Symptom Likely cause Fix
only root has access / no data Not run as root Use sudo iotop
?unavailable? in IO/SWAPIN columns Kernel or iotop build lacks delay accounting Enable CONFIG_TASK_DELAY_ACCT / CONFIG_TASK_IO_ACCOUNTING or upgrade kernel
Empty list with -o No active I/O at sample time Generate load or drop -o
Too many threads Thread-per-connection app Add -P for process view
iotop not found Package missing sudo apt install iotop on Ubuntu/Debian

References

Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.