I’m running a NAS on Fedora Server with LUKS encrypted Btrfs hard drives in a USB-C multi-bay enclosure. I noticed that one or both of the hard drives keep making the same sound as when I’m lightly reading or writing files from it (the closest it sounds like to my ear is something like copying to a Wi-Fi connected device where there is a bottleneck somewhere other than the hard drive, so it has bursts of activity a few times a second between idle time). Using iostat -x on my two main hard drives, I do see periodic activity every 10 or so seconds but I’m definitely not accessing anything in them, and the activity indicators on the USB enclosure are still and not blinking to indicate activity.
Should I be worried about this? To my paranoid mind it feels like something is slowly reading my files with some exploit to bypass the indicator light to fly under the radar. But I just did a clean install of Fedora Server 43 (over the previous installation which was 42) and I never installed anything outside of the official package manager and Docker registry. I’ve also never had this issue on Fedora Server 42 as far as I know, and the NAS is on my desk so I feel like I would have heard it ages ago if it was something frequent. There’s also no unexpected network activity on the Cockpit dashboard that would indicate that files are being uploaded, though I feel like if some malware can suppress the indicator light on a USB enclosure it can probably also hide its network traffic.
Is there something standard it’s doing that could explain this? Like does Fedora 43 more frequently tell the drive’s controller itself to do things like defragmentation or bit rot prevention when it’s idle? That’s the only explanation I can think of where the drive is clicking but no data is actually being transferred that would trigger the indicator light, since the operation would be entirely within the drive itself.
If the drive previously wasn’t making this noise (as in it had been filled with data, been in use for days-weeks and wasn’t ever making this noise) and it doesn’t happen in response to data writes (even hours after the fact) then it might be a cause for concern that the drive could be dying.
In general it’s a good idea to have back-ups of any important data but I’d really ensure that’s the case here and assume it could imminently fail. In general the sound of hard drives changing (that is sounding different in either idle noises or active writing/reading noises) is a cause for concern for potential drive failure though it could be other things and as drives age they can sometimes change sound signatures as mechanical components age without necessarily failing (could go on working fine for years).
That said there are normal processes in drives that can make noise:
Some sort of operation driven by your OS itself, I won’t begin to get into all of them but there could be something accessing things in the background, doing file table or journaling operations, writes, checks, etc on the file system itself, just low level maintenance stuff.
SMR drives may continue to write and shuffle data for quite some time after being written to, especially if it was a large amount of data. Though this should still even in the case of multiple terabytes probably be resolved within 12 hours.
Many drives, especially high capacity enterprise drives do make a -soft- clicking sound as a result of the arms sweeping the surface when idle but not off to if I recall correctly spread around lubricant or some sort of basic mechanical maintenance. It’s part of the normal drive operations. It’s possible it occurs more frequently in response to a massive amount of writes previously like filling a drive or may not be activated until a certain amount of data is written, I’m not really sure how that works as that would probably be proprietary information to the manufacturer.
How would it do this? Is it installing hacked firmware to your enclosure too? I doubt you’re that valuable of a target.
If you’re worried about malware then back up your stuff, nuke the install and reinstall from scratch. I wouldn’t worry about it if this is the only thing you’re seeing and find it unlikely.
Thank you for the in depth explanation of hard drive noises! I have everything I care about backed up and will keep listening for changes. Hopefully it’s just an OS thing.
Is your system writing logs?