When you've configured a Linux drive to spin down during inactivity (using hdparm -S or similar), but it keeps waking up unexpectedly, you're dealing with either legitimate background processes or something more sinister. Here's how to hunt down the culprit.

Start with iotop, the go-to tool for real-time disk I/O monitoring:

sudo iotop -o -P

For a more persistent approach, try logging disk activity:

sudo iotop -b -o -P -d 60 -t > disk_activity.log

The Linux audit subsystem provides detailed tracking:

sudo auditctl -w /path/to/mountpoint -p war -k disk_access
sudo ausearch -k disk_access | aureport -f -i

This will show all read/write/attribute changes to your drive.

Modern Linux distributions log disk events in the journal:

journalctl -k --grep="ata.*spin" --since "1 hour ago"
journalctl -u udisks2 --no-pager | grep -i mount

For targeted monitoring of specific directories:

inotifywait -m -r /mnt/torrents --format '%T %e %w%f' --timefmt '%H:%M:%S'

Sometimes the drive itself might be the issue:

sudo smartctl -a /dev/sdX | grep -i spin
sudo smartctl -l scttemp /dev/sdX

• Filesystem maintenance (ext4 journal, btrfs scrub)
• Desktop environment indexing (Tracker, Baloo)
• Backup services (rsnapshot, Timeshift)
• AV scanners (clamav, rkhunter)
• Systemd timers (systemctl list-timers)

Create a systemd service to prevent unnecessary access:

[Unit]
Description=Disable periodic access to torrent drive
After=network.target

[Service]
Type=oneshot
ExecStart=/bin/bash -c 'for timer in systemd-tmpfiles-clean.timer apt-daily.timer fwupd-refresh.timer; do systemctl mask $timer; done'

[Install]
WantedBy=multi-user.target

Remember to balance power saving with system functionality - some periodic accesses are necessary for filesystem health.

When you've configured a drive to spindown but notice periodic wake-ups (e.g., every 15 minutes), this typically indicates background processes or system services accessing the disk. Even with BitTorrent inactive, various system components might trigger disk activity.

Here are the most effective Linux utilities for tracking disk access:

# 1. iotop (requires root)
sudo iotop -oPa

# 2. fatrace (filesystem activity tracer)
sudo fatrace | grep 'your_mount_point'

# 3. lsof (list open files)
sudo lsof +D /path/to/mount | grep -v 'del'  # exclude deleted files

# 4. inotifywait (monitor filesystem events)
inotifywait -r -m /path/to/mount -e access,open

• Systemd journal rotation: Check with journalctl --disk-usage
• Updatedb (locate database): Verify with systemctl status mlocate
• File indexing services: Like baloo (KDE) or tracker (GNOME)
• AV scanning: Check for clamav or similar services

For deeper analysis, use bcc tools:

# Trace block I/O operations
sudo biosnoop

# Trace filesystem reads/writes
sudo opensnoop-bpfcc -n your_mount_point

# Trace sync operations
sudo syncsnoop-bpfcc

Once you identify the culprit, consider these fixes:

# Example: Disable mlocate updates
sudo systemctl disable mlocate.timer

# Example: Move journal to RAM
echo 'Storage=volatile' >> /etc/systemd/journald.conf

# Example: Exclude mount point from indexing
tracker reset --filesystem=your_mount_point

Create a watchdog script to log disk wake events:

#!/bin/bash
LOG_FILE="/var/log/disk_wake.log"
MOUNT_POINT="/mnt/torrents"

while true; do
    if [[ $(cat /sys/block/sdX/queue/rotational) -eq 1 ]] && \
       [[ $(hdparm -C /dev/sdX | grep -c "active/idle") -eq 1 ]]; then
        TIMESTAMP=$(date +"%Y-%m-%d %T")
        PROCESSES=$(lsof +D "$MOUNT_POINT")
        echo "[$TIMESTAMP] Disk spun up by:" >> "$LOG_FILE"
        echo "$PROCESSES" >> "$LOG_FILE"
    fi
    sleep 60
done