github.com/inspektor-gadget/inspektor-gadget@v0.28.1/docs/builtin-gadgets/top/file.md (about)

     1  ---
     2  title: 'Using top file'
     3  weight: 20
     4  description: >
     5    Periodically report read/write activity by file.
     6  ---
     7  
     8  The top file gadget is used to visualize reads and writes by file, with container details.
     9  
    10  ### On Kubernetes
    11  
    12  This guide will deploy an example workload that performs some disk I/O
    13  activity to show how to use `top file`.
    14  
    15  Before starting our workload, let's start our top file gadget to be sure it captures
    16  all the events from the beginning:
    17  
    18  ```bash
    19  $ kubectl gadget top file -p mypod
    20  K8S.NODE         K8S.NAMESPACE    K8S.POD          K8S.CONTAINER    PID     COMM             READS  WRITES R_Kb    W_Kb    T FILE
    21  ...
    22  ```
    23  
    24  The `T` column indicates the type of the file: `R` for regular files, `S` for
    25  sockets, and `O` for other (including pipes). By default only regular files are
    26  shown; use the `--all-files` option to show all file types.
    27  
    28  In another terminal, let's create our pod. It'll install `git` and then
    29  clone the linux source code.
    30  
    31  ```
    32  $ kubectl run -it mypod --image ubuntu -- /bin/sh -c "apt-get update && apt-get install -y git && git clone https://github.com/torvalds/linux"
    33  ```
    34  
    35  We can see how the `top file` terminal shows the files that are read and
    36  written by the pod. For instace, apt-get is reading a lot of files in
    37  when updating the packages list and installing packages.
    38  
    39  ```bash
    40  K8S.NODE         K8S.NAMESPACE    K8S.POD          K8S.CONTAINER    PID     COMM             READS  WRITES R_Kb    W_Kb    T FILE
    41  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          425    0      27022   0       R archive.ubuntu.com_ubuntu_dists_focal-updates_main_binary-amd64_Packages.lz4
    42  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          278    0      17775   0       R archive.ubuntu.com_ubuntu_dists_focal_main_binary-amd64_Packages.lz4
    43  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          244    0      15594   0       R security.ubuntu.com_ubuntu_dists_focal-security_main_binary-amd64_Packages.lz4
    44  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          93     0      5921    0       R archive.ubuntu.com_ubuntu_dists_focal_universe_binary-amd64_Packages.lz4
    45  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          91     0      5797    0       R archive.ubuntu.com_ubuntu_dists_focal-updates_universe_binary-amd64_Packages.lz4
    46  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          82     0      5160    0       R archive.ubuntu.com_ubuntu_dists_focal-updates_restricted_binary-amd64_Packages.lz4
    47  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          73     0      4568    0       R security.ubuntu.com_ubuntu_dists_focal-security_restricted_binary-amd64_Packages.lz4
    48  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          70     0      4435    0       R security.ubuntu.com_ubuntu_dists_focal-security_universe_binary-amd64_Packages.lz4
    49  ubuntu-hirsute   default          mypod            mypod            642727  apt-get          19     0      1172    0       R archive.ubuntu.com_ubuntu_dists_focal_multiverse_binary-amd64_Packages.lz4
    50  ```
    51  
    52  After the initial installation is done, we can see how git uses a
    53  temporary file to store the repository being cloned.
    54  
    55  ```
    56  K8S.NODE         K8S.NAMESPACE    K8S.POD          K8S.CONTAINER    PID     COMM             READS  WRITES R_Kb    W_Kb    T FILE
    57  ubuntu-hirsute   default          mypod            mypod            647042  git              0      1070   0       4280    R tmp_pack_2rpZd
    58  ```
    59  
    60  Finally, we need to clean up our pod, press Ctrl + C on its terminal and
    61  them remove it:
    62  
    63  ```bash
    64  $ kubectl delete pod mypod
    65  ```
    66  
    67  By default the top file gadget prints a summary each second. It can be customized
    68  with the `--interval` flag. For example, to print a summary each 5 seconds:
    69  
    70  ```bash
    71  $ kubectl gadget top file --interval 5
    72  ```
    73  
    74  This gadget also supports the following flags to customize the output:
    75  
    76  ```bash
    77  $ kubectl gadget top file --help
    78  Periodically report read/write activity by file
    79  
    80  Usage:
    81    kubectl-gadget top file [flags]
    82  
    83  Flags:
    84        --all-files              include non-regular file types (sockets, FIFOs, etc)
    85  ...
    86    -m, --max-rows uint32        Maximum number of rows to return (default 50)
    87  ...
    88  ```
    89  
    90  ### With `ig`
    91  
    92  Start a container that performs some write operations to a file:
    93  
    94  ```bash
    95  $ docker run --rm --name test-top-file busybox /bin/sh -c 'while true; do echo foo > bar; sleep 1; done'
    96  ```
    97  
    98  Start the gadget and it'll show those operations:
    99  
   100  ```bash
   101  $ sudo ig top file -c test-top-file
   102  RUNTIME.CONTAINERNAME                  PID        COMM             READS                WRITES               RBYTES               WBYTES               T FILE
   103  test-top-file                          139255     sh               0                    1                    0B                   4B                   R bar
   104  ```