osx - how to monitor operation on mac platform -


i trying file open/write/create operation, have tried fslogger can file creation/delete....and other operations, can not open/close operation, wrote driver it, can open/close operation can not create operation, what's more, it's messy! example, if open file , modify it, , close it, driver gets lot of open/write operations..i have no way tell 1 caused user open/close operation.. hints this? thanks.

your best bet going kauth system. install kauth handler (as kernel extension) , various callback codes when tries create, open or close file. involves getting callback in critical path of opening files, whatever has quick!

to quote:

kauth_scope_fileop defines following actions.

  • kauth_fileop_open
  • kauth_fileop_close
  • kauth_fileop_close_modified
  • kauth_fileop_rename
  • kauth_fileop_exchange
  • kauth_fileop_link
  • kauth_fileop_exec

https://developer.apple.com/library/mac/technotes/tn2127/_index.html

if you're writing kext have question of how info userland. fwiw used kqueue may have success method (let me know in comments if do!).

more info on kauth here , kqueue here. it's not brilliantly documented, there's enough info between 2 work out need do.


Comments

Popular posts from this blog

html - How to style widget with post count different than without post count -

How to remove text and logo OR add Overflow on Android ActionBar using AppCompat on API 8? -

javascript - storing input from prompt in array and displaying the array -