Disk I/O: show written file ?

[Hannes Mayer <debiandude@gmail.com>]

Hi all!

I need a tool for displaying which file is written to disk.
Actually I need to find out what is causing disk activity on a
machine, where all but the very necessary processes have been killed
and still there is some disk activity.

"iostat 1" shows a few written blocks every few 10s of seconds.

# ps -A
  PID TTY          TIME CMD
    1 ?        00:00:00 init
    2 ?        00:00:00 ksoftirqd/0
    3 ?        00:00:00 events/0
    4 ?        00:00:00 khelper
    5 ?        00:00:00 kblockd/0
    6 ?        00:00:00 pdflush
    7 ?        00:00:00 pdflush
    9 ?        00:00:00 aio/0
    8 ?        00:00:00 kswapd0
   10 ?        00:00:00 kseriod
   11 ?        00:00:00 kjournald
  458 tty2     00:00:00 getty
  459 tty3     00:00:00 getty
  460 tty4     00:00:00 getty
  461 tty5     00:00:00 getty
  462 tty6     00:00:00 getty
 8674 tty1     00:00:00 bash
 8737 tty1     00:00:00 ps

Swap is deactivated with "swapoff -a".
So there should be no process which writes to disk, but still: a few
blocks every few 10s of seconds.
How can I find out which file or what is written to disk ?
(I know "filemon", but that is for kernel 2.4 only. I need something
for kernel 2.6)

Thanks a lot & best regards,
Hannes.