This may be a general Unix question rather than a OS X question.

I want to log general file transfers on OS X, whether it be from and to the same system or to another system, but to keep it simple assume that this is all internal to one computer and file system.

I simply want to be able to execute the mv command several times, then go back through a log file and see what was moved and where it was moved at a later time. The caveat is that I want to also log file transfers initiated the GUI when dragging folders and files into the same log file.

(If it was a directory, it would also show the contents of what was moved in that directory.)

An Example might be these files created and moved in the terminal and in the GUI

     1pm: $ vi testfile1.txt
     2pm: $ mv testfile1.txt MyMovedFile.txt
     2:30pm – GUI file moved  ~/myTestFile.txt ~/Documents/myTestFile.txt
     3pm: $ mv MyMovedFile.txt MyNewFile.txt

The log would then show the history for me:

     2pm: testfile1.txt MyMovedFile.txt
     2:30pm ~/myTestFile.txt ~/Documents/myTestFile.txt
     3pm: MyMovedFile.txt MyNewFile.txt

If it was really fancy, it may show me the return code of the file transfer also.

  • 1
    Do you want to log all file moves or just some? Does that include moves from one disk to another (which are different under the hood: between different disks, mv copies then removes the original)? Is there a security concern, i.e. is it a problem if a user can evade the logging? Apr 4 '12 at 21:55
  • All file moves. Yes, between disks -- It is not a security concern, but I want to track what was transferred to where within a timeframe or as the log fills up. --
    – DogEatDog
    Apr 5 '12 at 3:43

Have a look at iosnoop or possibly fs_usage. Although what you want isn't easy to accomplish without major filtering, because "file transfers" can be a lot of different things at syscall level:

  • mv on the same mount point will move a file
  • mv across mount points will create a new file at the destination and unlink the original
  • Other tools will do even more complex things, for example if you're downloading a file with a browser it will create an empty file and then append to it over time.

Both above tools rely on DTrace, which is a very powerful tracing framework and can probably be scripted to filter down to most of what you want, but it'll take some work. There are example scripts in /usr/bin/*.d (e.g. /usr/bin/iofile.d) and documentation can be found at Oracle (OS X DTrace is a port of the original Solaris version).

  • iosnoop is very detailed, which is good. Still looking to see how I extract file moved - to and from.
    – DogEatDog
    Oct 17 '12 at 18:36

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .