I'm running a NAS on Fedora Server with LUKS encrypted Btrfs hard drives in a USB-C multi-bay enclosure. I noticed that one or both of the hard drives keep making the same sound as when I'm lightly reading or writing files from it (the closest it sounds like to my ear is something like copying to a Wi-Fi connected device where there is a bottleneck somewhere other than the hard drive, so it has bursts of activity a few times a second between idle time). Using iostat -x on my two main hard drives, I do see periodic activity every 10 or so seconds but I'm definitely not accessing anything in them, and the activity indicators on the USB enclosure are still and not blinking to indicate activity.

Should I be worried about this? To my paranoid mind it feels like something is slowly reading my files with some exploit to bypass the indicator light to fly under the radar. But I just did a clean install of Fedora Server 43 (over the previous installation which was 42) and I never installed anything outside of the official package manager and Docker registry. I've also never had this issue on Fedora Server 42 as far as I know, and the NAS is on my desk so I feel like I would have heard it ages ago if it was something frequent. There's also no unexpected network activity on the Cockpit dashboard that would indicate that files are being uploaded, though I feel like if some malware can suppress the indicator light on a USB enclosure it can probably also hide its network traffic.

Is there something standard it's doing that could explain this? Like does Fedora 43 more frequently tell the drive's controller itself to do things like defragmentation or bit rot prevention when it's idle? That's the only explanation I can think of where the drive is clicking but no data is actually being transferred that would trigger the indicator light, since the operation would be entirely within the drive itself.