# How to show exact process name that wrote to disk?

**URL:** <https://community.netdata.cloud/t/how-to-show-exact-process-name-that-wrote-to-disk/4975>\
**Category:** Help\
**Created:** [December 17, 2023, 6:30pm UTC](https://community.netdata.cloud/t/how-to-show-exact-process-name-that-wrote-to-disk/4975 "2023-12-17T18:30:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![danielmarschall](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/danielmarschall/32/3358_2.png) [@danielmarschall](https://community.netdata.cloud/u/danielmarschall)\
**Post date:** [December 17, 2023, 6:30pm UTC](https://community.netdata.cloud/t/how-to-show-exact-process-name-that-wrote-to-disk/4975/1 "2023-12-17T18:30:25Z")

</div>

Hello,

I am new to netdata and wonder if it is possible to see the process name that wrote to disk at a specific time. In this example, a process has written a lot of stuff to disk at 17:42:06, but the graph only shows “other”. How can I see the exact process name that caused this disk load?

 ![image](https://canada1.discourse-cdn.com/flex029/uploads/netdata2/original/2X/b/bf259729dd8f4b7ecb56faaa2f0753cad2b2d42d.png)

Thank you for your help.

My system:

```auto
$ netdata -v
netdata v1.37.1
$ netdata -W buildinfo
Version: netdata v1.37.1
Configure options: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' '--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu' '--runstatedir=/run' '--disable-maintainer-mode' '--disable-dependency-tracking' '--libdir=/usr/lib' '--libexecdir=/usr/lib' '--disable-cloud' '--enable-x86-sse' '--disable-exporting-prometheus-remote-write' '--enable-dbengine' '--enable-https' '--enable-plugin-cups' '--enable-plugin-nfacct' '--with-math' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -ffile-prefix-map=/build/netdata-aGlU9O/netdata-1.37.1=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -O3' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now -Wl,--as-needed' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -ffile-prefix-map=/build/netdata-aGlU9O/netdata-1.37.1=. -fstack-protector-strong -Wformat -Werror=format-security'
Install type: unknown
Features:
    dbengine: YES
    Native HTTPS: YES
    Netdata Cloud: NO (by user request)
    ACLK: NO
    TLS Host Verification: YES
    Machine Learning: NO
    Stream Compression: YES
Libraries:
    protobuf: YES (system)
    jemalloc: NO
    JSON-C: YES
    libcap: YES
    libcrypto: YES
    libm: YES
    tcalloc: NO
    zlib: YES
Plugins:
    apps: YES
    cgroup Network Tracking: YES
    CUPS: YES
    EBPF: NO
    IPMI: NO
    NFACCT: YES
    perf: YES
    slabinfo: YES
    Xen: NO
    Xen VBD Error Tracking: NO
Exporters:
    AWS Kinesis: NO
    GCP PubSub: NO
    MongoDB: NO
    Prometheus Remote Write: NO
Debug/Developer Features:
    Trace Allocations: NO

```

---

<div class="post-metadata">

**Author:** ![ralphm](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ralphm/32/1934_2.png) [@ralphm](https://community.netdata.cloud/u/ralphm)\
**Post date:** [December 19, 2023, 12:14pm UTC](https://community.netdata.cloud/t/how-to-show-exact-process-name-that-wrote-to-disk/4975/2 "2023-12-19T12:14:26Z")

</div>

Hi Daniel,

These charts are created by the so-called [apps.plugin](https://github.com/netdata/netdata/blob/master/collectors/apps.plugin/README.md), which groups processes based on the process tree. You can customize the apps groupings, by going into `/etc/netdata` and running `./edit-config apps_groups.conf`.

You can see [my own modifications in this gist](https://gist.github.com/ralphm/f3054028a1219630d8f0a390dc2ed589/revisions).

---

<div class="post-metadata">

**Author:** ![danielmarschall](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/danielmarschall/32/3358_2.png) [@danielmarschall](https://community.netdata.cloud/u/danielmarschall)\
**Post date:** [December 19, 2023, 1:10pm UTC](https://community.netdata.cloud/t/how-to-show-exact-process-name-that-wrote-to-disk/4975/3 "2023-12-19T13:10:52Z")

</div>

Hello Ralph,

thank you for your reply!

Unfortunately, this does not help, since this only works on processes which I am aware of. There are many users on the system, and they can basically work on their own, have their own batch scripts, etc. So, when a user is running a process which requires a lot of CPU and Disk usage, I would be interested in knowing which script this is. And if it is not running anymore, then I cannot see it in `top` or `htop` , so my hope was that I can see the process name in netdata’s history. Is there any “forensics” possible, any CSV export I can do, or do I really need to add _every_ executable file (i.e. all files which have chmod +x) on the whole system into apps\_groups.conf ?

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![KAGEYAM4](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/kageyam4/32/4005_2.png) [@KAGEYAM4](https://community.netdata.cloud/u/KAGEYAM4)\
**Post date:** [November 16, 2024, 10:12pm UTC](https://community.netdata.cloud/t/how-to-show-exact-process-name-that-wrote-to-disk/4975/4 "2024-11-16T22:12:13Z")

</div>

danielmarschall, did you found any solution? I am also looking for a way to track Total disk read/write done by process over a period of time.

i tried looking for apps.pwrite from the screenshot in netdata, but i couldn’t find it. Did it get removed ? What are you using now?

---

<div class="post-metadata">

**Author:** ![ilyam8](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ilyam8/32/134_2.png) [@ilyam8](https://community.netdata.cloud/u/ilyam8)\
**Post date:** [November 17, 2024, 3:00pm UTC](https://community.netdata.cloud/t/how-to-show-exact-process-name-that-wrote-to-disk/4975/5 "2024-11-17T15:00:50Z")

</div>

> Did it get removed ?

No. It is System-\>Processes-\>Apps-\>Disk “Applications Groups disk physical IO”.