Monthly Archives: March 2015

fs_usage – trace file system calls on Mac OS X

Introduction

fs_usage is an OS X command line utility that shows the network and file access operations that are happening on the operating system.  This is a handy utility when you want quick answers without firing up your debugger.

The Problem

For example, recently I ran into a problem where my data files for Outlook client on Mac had become corrupt.  My solution was a simple one –  delete all the data and Outlook profiles and let Outlook sync from the server once again. Deleting Outlooks files is not always a solution but in my case it was because I had everything on the server.

Now even after deleting all of the Outlook files under ~/Documents/, Outlook kept doing busy work without opening up my mail and it wasn’t able to repair my setup.

I wanted to quickly find out what files was Outlook still accessing so that I could delete them on my own and setup my mailbox from scratch.

This is where fs_usage came very handy.  This command is equivalent to strace on Unix/Linux and procmon on Windows. All these tools trace file operation system calls and display it to the end user. As fs_usage (or file system usage) is a privileged command, you need to have root access to execute this.

An Example

Following are the steps to trace the filesystem operations on a Mac  –

1. Get root access on the command prompt.

$ su
Password:

2. Find the PID of the process that you want to trace. Skip this step if you want to trace all file system calls for the operating system.

$ ps -A |grep Outlook
1888 ??       120:04.41 /Applications/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook
2878 ttys001    0:00.00 grep Outlook

Above 1888 is PID of Outlook on my machine.

3. Use the PID you got from step 2 with -f "pathname" option to display pathname operations for the process you are monitoring.

$ fs_usage -f "pathname" 1888
11:23:06.268558  lstat64                [  2]           /Users/xxx/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile - rebuilding [11]/Data/tmp/.commit                                  0.000003   Microsoft Outloo.24404
11:23:06.268566  lstat64                [  2]           /Users/xxx/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile - rebuilding [11]/Data/tmp/.commit                                  0.000002   Microsoft Outloo.24404
11:23:06.268569  lstat64                [  2]           /Users/xxx/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile - rebuilding [11]/Data/tmp/.commit                                  0.000002   Microsoft Outloo.24404

Under the Users/xxx/Library/Group Containers/ directory, Outlook is accessing profile files under a difficult to guess folder name. Deleting the files in this folder did fix my issue and I could setup Outlook from scratch.

Conclusion

fs_usage --help displays the various options that go with -f. Above, -f applies a pathname event filter. You can apply similar filters to show network, filesystem events.

fs_usage is a handy utility to know of. It is really useful when you need to observe the behavior of applications on your OS X machine without running an actual debugger.