6、查看进程状态
	ps -eo pid,user,wchan=WIDE-WCHAN-COLUMN -o s,cmd|awk ' $4 ~ /D/ {print $0}'
	lsof -p $pid

	/etc/init.d/syslog stop
	echo 1 > /proc/sys/vm/block_dump
	sleep 60
	dmesg | awk '/(READ|WRITE|dirtied)/ {process[$1]++} END {for (x in process) \
		print process[x],x}' |sort -nr |awk '{print $2 " " $1}' | \
	head -n 10

	echo 0 > /proc/sys/vm/block_dump
	/etc/init.d/syslog start

#include <sys/select.h>
#include <sys/inotify.h>
#include <unistd.h>
#include <signal.h>
#include <stdlib.h>
#include <stdio.h>

/**
 * Compilation : gcc inotify.c -o inotify -O2 -Wall -W -Werror -ansi -pedantic
 **/

int fd, wd;

void sigint_handler(int signum)
{
    (void) signum;

    /* Nous ne surveillons plus ce fichier/répertoire */
    if (inotify_rm_watch(fd, wd)) {
        perror("inotify_rm_watch");
        exit(EXIT_FAILURE);
    }

    /* Fermeture du descripteur de fichier obtenu lors de l'initialisation d'inotify */
    if (close(fd) < 0) {
        perror("close");
        exit(EXIT_FAILURE);
    }

    exit(EXIT_SUCCESS);
}

void afficher_masque(int mask)
{
    printf("Event : ");
    if (mask & IN_ACCESS)
        printf("IN_ACCESS");
    if (mask & IN_MODIFY)
        printf("IN_MODIFY");
    if (mask & IN_ATTRIB)
        printf("IN_ATTRIB");
    if (mask & IN_CLOSE)
        printf("IN_CLOSE");
    if (mask & IN_OPEN)
        printf("IN_OPEN");
    if (mask & IN_MOVED_FROM)
        printf("IN_MOVED_FROM");
    if (mask & IN_MOVED_TO)
        printf("IN_MOVED_TO");
    if (mask & IN_MOVE_SELF)
        printf("IN_MOVE_SELF");
    if (mask & IN_DELETE)
        printf("IN_DELETE");
    if (mask & IN_CREATE)
        printf("IN_CREATE");
    if (mask & IN_DELETE_SELF)
        printf("IN_DELETE_SELF");
    if (mask & IN_UNMOUNT)
        printf("IN_UNMOUNT");
    if (mask & IN_Q_OVERFLOW)
        printf("IN_Q_OVERFLOW");
    if (mask & IN_IGNORED)
        printf("IN_IGNORED");
    if (mask & IN_ISDIR)
        printf("IN_ISDIR");
    else
        printf("(file)");
}

int main(int argc, char *argv[])
{
    size_t r;
    fd_set fds;
    char buffer[8192];
    struct inotify_event *event;

    if (argc != 2) {
        fprintf(stderr, "usage : %s file or directory to monitor\n", argv[0]);
        return EXIT_FAILURE;
    }

    /* Initialisation d'inotify */
    fd = inotify_init();
    if (fd < 0) {
        perror("inotify_init");
        return EXIT_FAILURE;
    }

    /* Surveillance du fichier/répertoire passé en paramètre
     * On accepte tous les évènements possibles */
    wd = inotify_add_watch(fd, argv[1], IN_ALL_EVENTS);
    if (wd < 0) {
        perror("inotify_add_watch");
        return EXIT_FAILURE;
    }

    printf("Monitoring : '%s' (number = %d)\n", argv[1], wd);

    /* Capture de SIGINT (Ctrl + C) */
    signal(SIGINT, sigint_handler);

    while (1) {
        FD_ZERO(&fds);
        FD_SET(fd, &fds);
        if (select(fd + 1, &fds, NULL, NULL, 0) <= 0) {
            continue;
        }

        /* Obtention des informations sur l'évènement qui vient de se produire */
        r = read(fd, buffer, sizeof(buffer));
        if (r <= 0) {
            perror("read");
            return EXIT_FAILURE;
        }

        event = (struct inotify_event *) buffer;
        printf("Monitored file n°%d\t", event->wd);
        afficher_masque(event->mask);

        if (event->len) {
            printf("\tObject : %s", event->name);
        }
        printf("\n");
        
        /* Gedit act strangly, reload the file if we get an IN_DELETE_SELF event.
        if (event->mask & IN_DELETE_SELF) {
        	printf("Reloding watch");
        	inotify_rm_watch(fd, wd);
        	wd = inotify_add_watch(fd, argv[1], IN_ALL_EVENTS);
    		if (wd < 0) {
       			perror("inotify_add_watch");
        		return EXIT_FAILURE;
    		}*/
    }

    return EXIT_FAILURE;
}