CODEWITHSUNDEEP
objective-ccocoamacos
Ahmed Al Hafoudh
Ahmed Al Hafoudh

Reputation: 8429

Monitor file acess of a running application

Is it possible to monitor programatically file access of some running app on OSX? Creating/releasing file handle/descriptor? I need to know when some app reads from file and stops reading.

Upvotes: 2

Views: 813

Answers (1)

zpasternack
zpasternack

Reputation: 17898

I've not personally done what you're asking, but here are a few pointers that might get you started.

Mac OS X comes with a command-line program, fs_usage, that does that, and more. You might be able to launch it as a helper app and parse its output.

$ sudo fs_usage -f filesys Safari
22:43:27  stat64            ry/Safari/Bookmarks.plist    0.000063   Safari      
22:43:28  lstat64           English.lproj/Browser.nib    0.000025   Safari      
22:43:28  getattrlist       English.lproj/Browser.nib    0.000014   Safari      
22:43:28  getattrlist       English.lproj/Browser.nib    0.000017   Safari      
22:43:28  open              English.lproj/Browser.nib    0.000017   Safari      
22:43:28  getdirentriesattr                              0.000039   Safari      
22:43:28  close                                          0.000008   Safari

opensnoop does a similar thing.

$ sudo opensnoop
  UID    PID COMM          FD PATH                 
  205    284 locationd     -1 /dev/dlci.spi-baseband.9 
  501   2836 Safari        11 /Users/zach/Library/Cookies/Cookies.plist

opensnoop is built on dtrace, which could almost certainly do what you want. There's a decent tutorial on it here.

Finally, if you don't mind using private API, there's one which was built for Spotlight, which provides a notification system for filesystem changes. This tool is built on it. The source code is available.

Upvotes: 1

Related Questions