I’m running a NAS on Fedora Server with LUKS encrypted Btrfs hard drives in a USB-C multi-bay enclosure. I noticed that one or both of the hard drives keep making the same sound as when I’m lightly reading or writing files from it (the closest it sounds like to my ear is something like copying to a Wi-Fi connected device where there is a bottleneck somewhere other than the hard drive, so it has bursts of activity a few times a second between idle time). Using iostat -x on my two main hard drives, I do see periodic activity every 10 or so seconds but I’m definitely not accessing anything in them, and the activity indicators on the USB enclosure are still and not blinking to indicate activity.
Should I be worried about this? To my paranoid mind it feels like something is slowly reading my files with some exploit to bypass the indicator light to fly under the radar. But I just did a clean install of Fedora Server 43 (over the previous installation which was 42) and I never installed anything outside of the official package manager and Docker registry. I’ve also never had this issue on Fedora Server 42 as far as I know, and the NAS is on my desk so I feel like I would have heard it ages ago if it was something frequent. There’s also no unexpected network activity on the Cockpit dashboard that would indicate that files are being uploaded, though I feel like if some malware can suppress the indicator light on a USB enclosure it can probably also hide its network traffic.
Is there something standard it’s doing that could explain this? Like does Fedora 43 more frequently tell the drive’s controller itself to do things like defragmentation or bit rot prevention when it’s idle? That’s the only explanation I can think of where the drive is clicking but no data is actually being transferred that would trigger the indicator light, since the operation would be entirely within the drive itself.
How’s the overall health of the drives? You might want to get a quick SMART report.
Otherwise, this sounds like pretty normal drive activity. It could be the result of anything from indexing tools to casual background processes doing a read.
If it’s periodic in a way that’s consistent, then it’s almost definitely something in software. What docker services are you running? Do you have any auditing tools or security processes that might be actively logging activity?
It’s pretty unlikely you’ve contracted malware unless you’ve gone out of your way to expose the server to outside sources, so I think you can alay those concerns.
I tried using smartctl but it doesn’t seem to like the fact that it’s in a USB enclosure and says “unknown USB bridge”. Trying smartctl -d sat does give some SMART information and says that the “overall-health self-assessment test result” is passed for both based on “Attribute checks”, but I’m not sure if it’s actually passed or it just can’t see the actual failing information. It also says “SMART status not supported: Incomplete response, ATA output registers are missing” above the passed result which seems to indicate that it’s missing the information it needs for a full assessment.
I run Pi-Hole and Ollama in containers, but neither have mount points or volumes on the hard drives, only the system SSD.
One drive is a fairly new Seagate IronWolf Pro, but the other is a refurbished server hard drive so if one is dying it’s probably that one, though the stuff I actually care about is copied on both drives and a third one that’s offline and unplugged.
The weird thing is that this only started happening when I reinstalled the OS, but like I said I reinstalled with newer version so that might be the cause? Maybe some disk/fs implementation changed and now does things automatically when the drives are idle that 42 didn’t do? But I feel like that would still trigger the indicators.
My next step is probably to use inotify to look at file accesses, experiment with only mounting one drive at a time to see which one clicks or if they all do, maybe even connect the drives to another computer over SATA to do a full SMART check.
Thank you!
If you have SMR drives, it is normal for them to rearrange their contents during periods of user inactivity. The way Shingled Magnetic Recording crams more bytes into the same platter necessitates its own kind of “defragmenting”. Unless it’s host-managed SMR, it’s done by the drive’s onboard controller, so the OS won’t be aware.
If the drive previously wasn’t making this noise (as in it had been filled with data, been in use for days-weeks and wasn’t ever making this noise) and it doesn’t happen in response to data writes (even hours after the fact) then it might be a cause for concern that the drive could be dying.
In general it’s a good idea to have back-ups of any important data but I’d really ensure that’s the case here and assume it could imminently fail. In general the sound of hard drives changing (that is sounding different in either idle noises or active writing/reading noises) is a cause for concern for potential drive failure though it could be other things and as drives age they can sometimes change sound signatures as mechanical components age without necessarily failing (could go on working fine for years).
That said there are normal processes in drives that can make noise:
-
Some sort of operation driven by your OS itself, I won’t begin to get into all of them but there could be something accessing things in the background, doing file table or journaling operations, writes, checks, etc on the file system itself, just low level maintenance stuff.
-
SMR drives may continue to write and shuffle data for quite some time after being written to, especially if it was a large amount of data. Though this should still even in the case of multiple terabytes probably be resolved within 12 hours.
-
Many drives, especially high capacity enterprise drives do make a -soft- clicking sound as a result of the arms sweeping the surface when idle but not off to if I recall correctly spread around lubricant or some sort of basic mechanical maintenance. It’s part of the normal drive operations. It’s possible it occurs more frequently in response to a massive amount of writes previously like filling a drive or may not be activated until a certain amount of data is written, I’m not really sure how that works as that would probably be proprietary information to the manufacturer.
Should I be worried about this? To my paranoid mind it feels like something is slowly reading my files with some exploit to bypass the indicator light to fly under the radar.
How would it do this? Is it installing hacked firmware to your enclosure too? I doubt you’re that valuable of a target.
If you’re worried about malware then back up your stuff, nuke the install and reinstall from scratch. I wouldn’t worry about it if this is the only thing you’re seeing and find it unlikely.
Thank you for the in depth explanation of hard drive noises! I have everything I care about backed up and will keep listening for changes. Hopefully it’s just an OS thing.
Is your system writing logs?
-
Hard drives don’t normally make a clicking noise unless it’s the head resetting due to an error. I’d definitely check the health of that drive, and make sure your backups are working.
