iosnoop [-a|-A|-Deghinostv] [-d device] [-f filename] [-m mount_point] [-n name] [-p PID]
outputs I/O events as they happen, with useful details such as UID, PID, block number, size, filename, etc.
Useful to determine the process responsible for using the disks, as well as details on what activity the process is requesting. Behaviour such as random or sequential I/O can be observed by reading the block numbers. Uses DTrace, only users with root privileges can run this command.
-f filename |
sudo iosnoopPrint human readable timestamps,
sudo iosnoop -vPrint major and minor numbers,
STRTIME UID PID D BLOCK SIZE COMM PATHNAME
2012 Aug 4 11:31:04 503 2312 W 5507984 4096 thunderbird ??/dgerman/popstate.dat
2012 Aug 4 11:31:04 503 2312 W 5507984 4096 thunderbird ??/dgerman/popstate.dat
Snoop events on the root filesystem only,sudo iosnoop -N MAJ MIN UID PID D BLOCK SIZE COMM PATHNAME 14 6 503 1287 R 5540248 4096 Terminal ??/com.apple.Terminal.savedState/data.data 14 6 503 1287 R 5540296 8192 Terminal ??/com.apple.Terminal.savedState/data.data 14 6 503 1287 R 5540304 4096 Terminal ??/com.apple.Terminal.savedState/data.data 14 6 503 1287 W 5540248 40960 Terminal ??/com.apple.Terminal.savedState/data.data 14 6 503 1287 W 5508240 4096 Terminal ??/com.apple.Terminal.savedState/windows.plist 14 2 503 13308 W 49549800 4096 sed ??/tmp/dfdf_1 14 2 503 13316 W 49549808 4096 sed ??/tmp/dfdf_0 14 6 503 2312 W 5508248 4096 thunderbird ??/dgerman/popstate.dat 14 6 503 2312 W 5508248 4096 thunderbird ??/dgerman/popstate.dat 14 2 503 13326 W 49549800 4096 sed ??/tmp/dfdf_1 14 2 503 13388 W 49549808 4096 sed ??/tmp/dfdf_0 14 6 503 2312 W 5508528 20480 thunderbird ??/dgermanx/popstate.dat 14 6 503 2312 W 5508528 20480 thunderbird ??/dgermanx/popstate.dat 14 2 503 13398 W 49549800 4096 sed ??/tmp/dfdf_1 14 2 503 13406 W 49549808 4096 sed ??/tmp/dfdf_0 14 2 0 1 W 49759184 4096 launchd ??/asl/2012.08.04.U0.G80.asl 14 2 0 1 W 49760040 4096 launchd ??/asl/2012.08.04.U0.G80.asl 14 2 0 1 W 49760096 4096 launchd ??/asl/2012.08.04.U0.G80.asl 14 2 0 1 W 49760752 4096 launchd ??/asl/2012.08.04.G80.asl 14 2 0 1 W 49775752 4096 launchd ??/asl/2012.08.04.G80.asl 14 2 0 1 W 49760088 4096 launchd ??/log/07_debug.log 14 2 0 1 W 49551632 4096 launchd ??/log/06_info.log 14 2 0 1 W 30298120 4096 launchd ??/asl/StoreData 14 6 0 1 W 28136 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 14 6 0 1 W 1508952 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 14 6 0 1 W 1650920 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 14 2 0 1 W 49759128 4096 launchd ??/log/system.log 14 2 0 1 W 49549712 4096 launchd ??/log/secure.log 14 2 0 1 W 49551424 4096 launchd ??/log/05_notice.log 14 2 0 1 W 44825056 4096 launchd ??/log/04_warn.log 14 2 0 1 W 59653408 4096 launchd ??/log/03_err.log sudo iosnoop -v -o -D|grep -v dfdf STRTIME DELTA DTIME UID PID D BLOCK SIZE COMM PATHNAME 2012 Aug 4 11:40:16 1098 1114 503 1287 R 5540880 4096 Terminal ??/com.apple.Terminal.savedState/data.data 2012 Aug 4 11:40:16 155 163 503 1287 W 5540880 4096 Terminal ??/com.apple.Terminal.savedState/data.data 2012 Aug 4 11:40:16 1842 1715 503 1287 W 5541272 184320 Terminal ??/com.apple.Terminal.savedState/data.data 2012 Aug 4 11:40:16 1846 264 503 1287 W 5541632 4096 Terminal ??/com.apple.Terminal.savedState/windows.plist 2012 Aug 4 11:40:23 260 276 0 1 W 49759184 4096 launchd ??/asl/2012.08.04.U0.G80.asl 2012 Aug 4 11:40:23 263 64 0 1 W 49760096 4096 launchd ??/asl/2012.08.04.U0.G80.asl 2012 Aug 4 11:40:23 251 263 0 1 W 49759200 4096 launchd ??/log/system.log 2012 Aug 4 11:40:23 238 50 0 1 W 49549712 4096 launchd ??/log/secure.log 2012 Aug 4 11:40:23 282 83 0 1 W 49551432 4096 launchd ??/log/05_notice.log 2012 Aug 4 11:40:23 448 193 0 1 W 44825064 4096 launchd ??/log/04_warn.log 2012 Aug 4 11:40:23 508 84 0 1 W 59653408 4096 launchd ??/log/03_err.log 2012 Aug 4 11:40:23 274 289 0 1 W 49760752 4096 launchd ??/asl/2012.08.04.G80.asl 2012 Aug 4 11:40:23 280 64 0 1 W 49775752 4096 launchd ??/asl/2012.08.04.G80.asl 2012 Aug 4 11:40:23 277 284 0 1 W 49760104 4096 launchd ??/log/07_debug.log 2012 Aug 4 11:40:23 358 107 0 1 W 49551640 4096 launchd ??/log/06_info.log 2012 Aug 4 11:40:23 424 96 0 1 W 30298120 4096 launchd ??/asl/StoreData 2012 Aug 4 11:40:23 574 594 0 1 W 28136 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> … 2012 Aug 4 11:40:23 2388 123 0 1 W 6336136 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 2012 Aug 4 11:40:27 24803 24823 503 2312 R 16882032 98304 thunderbird ??/MacOS/XUL 2012 Aug 4 11:40:27 15001 15017 503 2312 R 16865560 245760 thunderbird ??/MacOS/XUL 2012 Aug 4 11:40:48 18499 18515 503 1287 R 5540248 4096 Terminal ??/com.apple.Terminal.savedState/data.data … 2012 Aug 4 11:40:48 7063 186 503 1287 W 5541272 8192 Terminal ??/com.apple.Terminal.savedState/data.data 2012 Aug 4 11:40:48 6934 113 503 1287 W 5541288 4096 Terminal ??/com.apple.Terminal.savedState/windows.plist 2012 Aug 4 11:40:53 486 506 0 1 W 28136 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 2012 Aug 4 11:40:53 535 85 0 1 W 138776 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 2012 Aug 4 11:40:53 574 72 0 1 W 159376 4096 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 2012 Aug 4 11:40:53 626 82 0 1 W 1491208 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 2012 Aug 4 11:40:54 249 269 0 1 W 1520 4096 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 2012 Aug 4 11:40:54 320 107 0 1 W 6133800 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)> 2012 Aug 4 11:40:55 252 272 503 2312 W 5541296 4096 thunderbird ??/dgerman/popstate.dat 2012 Aug 4 11:40:55 919 930 503 2312 W 5541296 4096 thunderbird ??/dgerman/popstate.dat 2012 Aug 4 11:41:10 9565 9580 503 2312 R 5082624 4096 thunderbird ??/thunderBird/zhicom.msf 2012 Aug 4 11:41:10 25711 25731 503 2312 R 58562696 4096 thunderbird ??/Paddling.sbd/PhillyRegatta.msf 2012 Aug 4 11:41:10 279 293 503 2312 R 58562704 4096 thunderbird ??/Paddling.sbd/PhillyRegatta.msf 2012 Aug 4 11:41:10 313 89 503 2312 R 58562712 8192 thunderbird ??/Paddling.sbd/PhillyRegatta.msf 2012 Aug 4 11:41:10 234 248 503 2312 R 58562728 16384 thunderbird ??/Paddling.sbd/PhillyRegatta.msf 2012 Aug 4 11:41:10 324 334 503 2312 R 58562760 32768 thunderbird ??/Paddling.sbd/PhillyRegatta.msf 2012 Aug 4 11:41:10 476 439 503 2312 R 58562824 45056 thunderbird ??/Paddling.sbd/PhillyRegatta.msf 2012 Aug 4 11:41:10 355 375 503 2312 W 5541304 20480 thunderbird ??/dgermanx/popstate.dat 2012 Aug 4 11:41:10 491 504 503 2312 W 5541304 20480 thunderbird ??/dgermanx/popstate.dat 2012 Aug 4 11:41:18 21910 21930 222 66 R 50260528 4096 netbiosd ??/A/SMBClient/..namedfork/rsrc 2012 Aug 4 11:41:18 471 487 222 66 R 50260536 28672 netbiosd ??/A/SMBClient/..namedfork/rsrc 2012 Aug 4 11:41:18 339 354 222 66 R 50260592 24576 netbiosd ??/A/SMBClient/..namedfork/rsrc 2012 Aug 4 11:41:18 11789 11799 222 66 R 49773952 4096 netbiosd ??/SystemConfiguration/com.apple.smb.server.plist 2012 Aug 4 11:41:18 13890 13904 222 66 R 37529224 344064 netbiosd ??/dyld/dyld_shared_cache_x86_64 2012 Aug 4 11:41:18 1576 1590 222 66 R 37529896 180224 netbiosd ??/dyld/dyld_shared_cache_x86_64 2012 Aug 4 11:41:18 9778 9793 222 66 R 27079896 339968 netbiosd ??/dyld/dyld_shared_cache_x86_64 2012 Aug 4 11:41:18 15060 15071 222 66 R 37583768 40960 netbiosd ??/dyld/dyld_shared_cache_x86_64 2012 Aug 4 11:41:18 14787 14797 222 66 R 24268168 208896 netbiosd ??/dyld/dyld_shared_cache_x86_64 2012 Aug 4 11:41:18 9132 9147 0 17263 R 10246104 4096 launchd ??/sbin/gssd/..namedfork/rsrc 2012 Aug 4 11:41:18 461 473 0 17263 R 10246112 24576 launchd ??/sbin/gssd/..namedfork/rsrc 2012 Aug 4 11:41:18 339 353 0 17263 R 10246160 28672 gssd ??/sbin/gssd/..namedfork/rsrc 2012 Aug 4 11:41:18 9050 9065 65 12 R 50248768 16384 mDNSResponder ??/sbin/mDNSResponder/..namedfork/rsrc 2012 Aug 4 11:41:18 160 171 0 17263 R 9573248 4096 gssd ??/MacOS/heimdalodpac/..namedfork/rsrc 2012 Aug 4 11:41:18 14309 14323 0 17263 R 26899976 4096 gssd ??/etc/hosts 2012 Aug 4 11:41:18 7386 7403 0 17263 R 9573256 4096 gssd ??/MacOS/heimdalodpac/..namedfork/rsrc 2012 Aug 4 11:41:18 201 214 0 17263 R 9573240 4096 gssd ??/MacOS/heimdalodpac/..namedfork/rsrc 2012 Aug 4 11:41:18 9230 9242 0 17263 R 42517000 4096 gssd ??/MacOS/Reachability/..namedfork/rsrc 2012 Aug 4 11:41:18 277 290 0 17263 R 42516984 4096 gssd ??/MacOS/Reachability/..namedfork/rsrc 2012 Aug 4 11:41:18 238 254 0 17263 R 42516992 4096 gssd ??/MacOS/Reachability/..namedfork/rsrc 2012 Aug 4 11:41:18 176 190 0 17263 R 42517024 4096 gssd ??/MacOS/SCKerberosConfig/..namedfork/rsrc 2012 Aug 4 11:41:18 187 198 0 17263 R 42517008 4096 gssd ??/MacOS/SCKerberosConfig/..namedfork/rsrc 2012 Aug 4 11:41:18 205 217 0 17263 R 42517016 4096 gssd ??/MacOS/SCKerberosConfig/..namedfork/rsrc 2012 Aug 4 11:41:18 275 301 0 17263 R 10246232 4096 gssd ??/sbin/gssd/..namedfork/rsrc 2012 Aug 4 11:41:20 200 216 503 1287 W 5500136 4096 Terminal ??/com.apple.Terminal.savedState/window_2.data 2012 Aug 4 11:41:20 1039 1046 503 1287 R 5541280 4096 Terminal ??/com.apple.Terminal.savedState/data.data 2012 Aug 4 11:41:20 714 721 503 1287 W 5541280 4096 Terminal ??/com.apple.Terminal.savedState/data.data 2012 Aug 4 11:41:20 768 75 503 1287 W 5541344 4096 Terminal ??/com.apple.Terminal.savedState/data.data 2012 Aug 4 11:41:20 654 49 503 1287 W 5541352 4096 Terminal ??/com.apple.Terminal.savedState/windows.plist 2012 Aug 4 11:41:24 622 642 0 1 W 28136 8192 launchd ??/<unknown (NULL v_parent)>/<unknown (NULL v_name)>
sudo iosnoop -m /
UID |