Command to find out current process writing to hard disk.
lsof | grep -e “[[:digit:]]+w”
It will show output like below
root@:~ # lsof | grep -e “[[:digit:]]+w” [20:36:57]
systemd-j 410 root 1w CHR 1,3 0t0 5342 /dev/null
systemd-j 410 root 2w CHR 1,3 0t0 5342 /dev/null
systemd-j 410 root 6w CHR 1,11 0t0 5348 /dev/kmsg
auditd 500 root 4w REG 253,1 2613671 13129199 /var/log/audit/audit.log
auditd 500 508 root 4w REG 253,1 2613671 13129199 /var/log/audit/audit.log
chronyd 574 chrony 1w CHR 1,3 0t0 5342 /dev/null
gssproxy 577 root 10w FIFO 0,9 0t0 15996 pipe
gssproxy 577 584 root 10w FIFO 0,9 0t0 15996 pipe
gssproxy 577 585 root 10w FIFO 0,9 0t0 15996 pipe
gssproxy 577 586 root 10w FIFO 0,9 0t0 15996 pipe
gssproxy 577 587 root 10w FIFO 0,9 0t0 15996 pipe
gssproxy 577 588 root 10w FIFO 0,9 0t0 15996 pipe
tuned 1018 root 3w REG 253,1 16221 8726875 /var/log/tuned/tuned.log
tuned 1018 root 9w CHR 10,61 0t0 7884 /dev/cpu_dma_latency
tuned 1018 root 11w FIFO 0,9 0t0 18638 pipe
gmain 1018 1495 root 3w REG 253,1 16221 8726875 /var/log/tuned/tuned.log
gmain 1018 1495 root 9w CHR 10,61 0t0 7884 /dev/cpu_dma_latency
gmain 1018 1495 root 11w FIFO 0,9 0t0 18638 pipe
tuned 1018 1503 root 3w REG 253,1 16221 8726875 /var/log/tuned/tuned.log
tuned 1018 1503 root 9w CHR 10,61 0t0 7884 /dev/cpu_dma_latency
tuned 1018 1503 root 11w FIFO 0,9 0t0 18638 pipe
tuned 1018 1715 root 3w REG 253,1 16221 8726875 /var/log/tuned/tuned.log
tuned 1018 1715 root 9w CHR 10,61 0t0 7884 /dev/cpu_dma_latency
tuned 1018 1715 root 11w FIFO 0,9 0t0 18638 pipe
tuned 1018 1897 root 3w REG 253,1 16221 8726875 /var/log/tuned/tuned.log
tuned 1018 1897 root 9w CHR 10,61 0t0 7884 /dev/cpu_dma_latency
tuned 1018 1897 root 11w FIFO 0,9 0t0 18638 pipe
httpd 2389 apache 2w REG 253,1 4019 35502499 /var/log/httpd/error_log
httpd 2389 apache 6w FIFO 0,9 0t0 157649015 pipe
httpd 2389 apache 7w REG 253,1 0 33592998 /var/log/httpd/ssl_error_log
httpd 2389 apache 8w REG 253,1 656688 35502491 /var/log/httpd/access_log
httpd 2389 apache 9w REG 253,1 0 33593001 /var/log/httpd/ssl_access_log
httpd 2389 apache 10w REG 253,1 0 33593002 /var/log/httpd/ssl_request_log
httpd 2389 apache 12w REG 0,20 0 157649021 /run/httpd/wsgi.14323.9.1.lock (deleted)
nagios 4017 nagios 1w CHR 1,3 0t0 5342 /dev/null
nagios 4017 nagios 2w CHR 1,3 0t0 5342 /dev/null
nagios 4017 nagios 12w REG 253,1 65192826 46137437 /usr/local/nagios/var/host-perfdata
nagios 4017 nagios 13w REG 253,1 1 46216438 /usr/local/nagios/var/service-perfdata
nagios 4019 nagios 1w CHR 1,3 0t0 5342 /dev/null