Introduction
fs_usage is an OS X command line utility that shows the network and file access operations that are happening on the operating system. This is a handy utility when you want quick answers without firing up your debugger.
The Problem
For example, recently I ran into a problem where my data files for Outlook client on Mac had become corrupt. My solution was a simple one – delete all the data and Outlook profiles and let Outlook sync from the server once again. Deleting Outlooks files is not always a solution but in my case it was because I had everything on the server.
Now even after deleting all of the Outlook files under ~/Documents/, Outlook kept doing busy work without opening up my mail and it wasn’t able to repair my setup.
I wanted to quickly find out what files was Outlook still accessing so that I could delete them on my own and setup my mailbox from scratch.
This is where fs_usage came very handy. This command is equivalent to strace on Unix/Linux and procmon on Windows. All these tools trace file operation system calls and display it to the end user. As fs_usage (or file system usage) is a privileged command, you need to have root access to execute this.
An Example
Following are the steps to trace the filesystem operations on a Mac –
1. Get root access on the command prompt.
$ su Password:
2. Find the PID of the process that you want to trace. Skip this step if you want to trace all file system calls for the operating system.
$ ps -A |grep Outlook 1888 ?? 120:04.41 /Applications/Microsoft Outlook.app/Contents/MacOS/Microsoft Outlook 2878 ttys001 0:00.00 grep Outlook
Above 1888 is PID of Outlook on my machine.
3. Use the PID you got from step 2 with -f "pathname" option to display pathname operations for the process you are monitoring.
$ fs_usage -f "pathname" 1888
11:23:06.268558 lstat64 [ 2] /Users/xxx/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile - rebuilding [11]/Data/tmp/.commit 0.000003 Microsoft Outloo.24404
11:23:06.268566 lstat64 [ 2] /Users/xxx/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile - rebuilding [11]/Data/tmp/.commit 0.000002 Microsoft Outloo.24404
11:23:06.268569 lstat64 [ 2] /Users/xxx/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile - rebuilding [11]/Data/tmp/.commit 0.000002 Microsoft Outloo.24404
Under the Users/xxx/Library/Group Containers/ directory, Outlook is accessing profile files under a difficult to guess folder name. Deleting the files in this folder did fix my issue and I could setup Outlook from scratch.
Conclusion
fs_usage --help displays the various options that go with -f. Above, -f applies a pathname event filter. You can apply similar filters to show network, filesystem events.
fs_usage is a handy utility to know of. It is really useful when you need to observe the behavior of applications on your OS X machine without running an actual debugger.