Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Now, I can find out which processes are opening files dynamically. However, for a file on my filesystem, is there a way to find out which process created the file?

I'm trying to differentiate a file I created by:

touch(1)

from one created by say, an NSAPI process running under my id.

lastcomm(1)

will give me information such as which tty is doing something, is that an attribute I can access?

Essentially, my id does a bunch of stuff. Much of what my id does should be via applications, or from a terminal. I'd like to find out more. Suggestions?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Darwin is open source. I'm guessing you'll need to modify OS level things, a kernel extension, etc. and add this ability.

Or you could modify the dynamic-view tools you know (fs_usage and/or lsof), have them check if a file is being created, and append the process chain that created it into the Spotlight comment, etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.