12

Two files have suddenly appeared in my home directory, called "aa" and "err". They are empty. I'm wondering how they got there. I deleted the files and they are created again after some seconds.

Is there a way to monitor the home directory for the creation of files to find out where they came from?

I mention that lsof couldn't help in this case (I got an empty result using lsof aa)

Improve this question
2

1 Answer 1

Reset to default
20

fs_usage is your tool for this.

The file system usage tool is ideal since it taps in to the real time file system events and dumps activity to a file or the screen. Since you know the exact path of the file, you can filter out all the thousands of irrelevant (to this case) filesystem changes and see what reads / writes to that file pretty quickly.

If your home directory is /Users/me then you can filter for /Users/me/aa

mac:~ me$ sudo fs_usage | grep /Users/me/aa
09:35:21  stat64            /Users/me/aa      0.000033   touch       
09:35:21  utimes            /Users/me/aa      0.000104   touch       
09:35:21  fsgetpath         /Users/me/aa      0.000119   Finder      
09:35:22  lstat64           /Users/me/aa      0.000039   fseventsd   
09:35:22  fsgetpath         /Users/me/aa      0.000027   mds         
09:35:22  getattrlist       /Users/me/aa      0.000064   mds         
09:35:22  listxattr         /Users/me/aa      0.000012   mds         
09:35:22  getattrlist       /Users/me/aa      0.000130   mds         
09:35:22  getattrlist       /Users/me/aa      0.000033   mds         
09:35:22  open              /Users/me/aa      0.000071   mdworker_sha
09:35:22    RdData[AT2]     /Users/me/aa      0.000331 W mdworker_sha
09:35:22  getattrlist       /Users/me/aa      0.000042   mds         
09:35:24  lstat64           /Users/me/aa      0.000114   rm          
09:35:24  access            /Users/me/aa      0.000209   rm          
09:35:24  unlink            /Users/me/aa      0.000909   rm          
09:35:25  lstat64           /Users/me/aa      0.000042   fseventsd   
09:35:25  lstat64           /Users/me/aa      0.000006   rm

(note: I deleted a lot of white space above - the fs_usage command outputs a wide amount of empty space so you can't easily see the touch command on the far right if I copy/paste the exact output.)

Here I use the touch command to create the file, append a string to it and then rm it from the command line.

mac:~ me$ touch ~/aa
mac:~ me$ echo foo >> ~/aa
mac:~ me$ rm ~/aa

There will be tons of other apps that read, so you can filter on the stat64 and lstat74 operations if there are too many attribute reads and spotlight activity around the file once it's created.

The manual page for this command is quite dense (and not a "how-to") which is typical but better than no documentation from Apple on how to use it.

Improve this answer
5
  • Wow thanks. great answer. I believe fs_usage command bases on the FSEvents facility of MacOS. Do you know if this facility can be used also from within an iOS application?
    – Motti Shneor
    Jan 2, 2019 at 7:00
  • @bmike, when using touch we can see stat64 and open commands. I am wondering what command creates actually the file. In my case I get directly the following without anything before fsgetpath of Finder : imgur.com/a/AsA9O5s
    – Kwadz
    Jan 7, 2019 at 10:28
  • That would make a good follow on question. In my case, the stat64 created the file. I doubt Finder and mds are creating the file in your case so I would need to see more of the logs to help out. @Kwadz When you delete the file, what is the first entry in the fs_usage?
    – bmike ♦
    Jan 7, 2019 at 15:33
  • @bmike, I get the following when I delete the file from Finder: imgur.com/a/ldYGNRZ
    – Kwadz
    Jan 8, 2019 at 11:26
  • Great. Then does it stay gone? If not, you might need to make a new account and restart into the new account and narrow down if a user process is creating it or a system process is. That second user could then presumably set up the trap before the user that creates the file logs in, allowing you to capture the first trace and not the ones after it's created or being removed.
    – bmike ♦
    Jan 8, 2019 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .