sar or vmstat whatedver u mentioned should be good enough for initial I/O investigation. Then you may get into details using iostat or similar command and at same time get the pid track it what it's doing.