What's causing all the disk activity on OS X?

From man iotop:

iotop tracks disk I/O by process, and prints a summary report that is refreshed every interval.

This is measuring disk events that have made it past system caches.

Since this uses DTrace, only the root user or users with the dtrace_kernel privilege can run this command.

This may not be precisely what you want - but it's a ksh script which wraps around dtrace, so you should be able to figure out how to make dtrace do what you need, if iotop doesn't handle it by default.

However, something like iotop -C 5 12 should give you something to start with: it will output 12 samples, each 5 seconds long.

You can also use fs_usage to get a blow-by-blow account of what apps are hitting the disk.

I always noticed this on Saturday mornings, and it turned out to be locate, which updates its database at 3:15am on Friday nights.

I tried disabling its launchd configuration (in /System/Library/LaunchDaemons/com.apple.locate.plist), but it still ran anyway, so I just moved /usr/libexec/locate.updatedb out of the way. Problem…mitigated.

It might be the OS paging to virtual memory instead of something application specific. You might try quitting less frequently used applications or at least restarting some applications that like to build up in-memory caches over time (e.g. Safari). Check out the various per-process memory statistics with Activity Monitor to find likely culprits. If quitting some memory intensive applications seems to temporarily alleviate the problem, you might try adding RAM.

If the disk activity is not paging related, you might be able to use fs_usage to track it back to one or more specific processes.