Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Click here to return to the '10.5: Exploring OS X with dtrace' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
10.5: Exploring OS X with dtrace
Authored by: nKhona on Oct 31, '07 01:54:18PM
lsof - LiSt Open Files is another great way to do this same thing.

[ Reply to This | # ]
10.5: Exploring OS X with dtrace
Authored by: kaih on Oct 31, '07 02:02:05PM

No, they're subtly different.

lsof will take a "snapshot" and give you a one-time view of all file handles (and this includes things like TCP ports) that are open at the instant the program was run.

using dtrace, you will see file system activity in realtime - it's more similar to:

sudo fs_usage | grep -i open


[ Reply to This | # ]
10.5: Exploring OS X with dtrace
Authored by: ebrandwine on Oct 31, '07 02:03:08PM

Sorta. Not really. lsof is wonderful, but it prints a static dump of what's happening on the system right now. The dtrace example given above will print every file as it's opened. You can leave it running in a terminal, and spy on your system.

A much more complex example, one that's basically impossible with other tracing tools, is e.g. to print out details of all filesystem changes that happen within 100ms of a network connection being established. I've used this in production to figure out where a commercial product was stuffing connection data on disk.

(My day job is administering Solaris systems, FWIW)


[ Reply to This | # ]