Filesystem usage (process/pathname) Requires root privileges due to the kernel tracing facility it uses to operate.
Syntax
fs_usage [-e] [-w] [-f mode] [-b] [-t seconds]
[-R rawfile [-S start_time -E end_time]] [pid | cmd [pid | cmd [...]]]
Options
-e Generates output that excludes sampling of the running fs_usage tool.
If a list of process IDs or commands is also given, then those
processes are also excluded from the sampled output.
-w Force a wider, more detailed output, regardless of the window size.
-f Turn on output filtering based on the mode provided.
Multiple filtering options can be specified. By default, no output filtering occurs.
The supported modes are:
network Network-related events are displayed.
filesys Filesystem-related events are displayed.
pathname Pathname-related events are displayed.
exec Exec and spawn events are displayed.
diskio Disk I/O events are displayed.
cachehit In addition, show cache hits.
-b Annotate disk I/O events with BootCache info (if available).
-t seconds
A run timeout in seconds.
fs_usage will run for no longer than the timeout specified.
-R raw_file
A raw trace file to process.
-S start_time
A start time in microseconds to begin processing entries from the raw trace file.
Entries with timestamps before the specified start time will be skipped.
-E end_time
An ending time in microseconds to stop processing entries from the raw trace file.
Entries with timestamps beyond the specified ending time will be skipped.
pid | cmd
The sampled data can be limited to a list of process IDs or commands.
When a command name is given, all processes with that name will be sampled.
Using the -e option has the opposite effect, excluding sampled data relating
to the given list of process IDs or commands.
TIMESTAMP TOD when call occurred. Wide mode will have microsecond granularity. CALL The name of the network or filesystem related call, page-in, page-out, or physical disk access. FILE DESCRIPTOR Of the form F=x, x is a file descriptor. Depending on the type of system call, this will be either an input value or a return value. BYTE COUNT Of the form B=x, x is the number of bytes requested by the call. [ERRNO] On error, the errno is displayed in brackets. PATHNAME Pathname of the file accessed (up to the last 28 bytes). FAULT ADDRESS Of the form A=0xnnnnnnnn, where 0xnnnnnnnn is the address being faulted. DISK BLOCK NUMBER Of the form D=0xnnnnnnnn, where 0xnnnnnnnn is the block number of the physical disk block being read or written. OFFSET Of the form O=0xnnnnnnnn, where 0xnnnnnnnn is a file offset. SELECT RETURN Of the form S=x, x is the number of ready descriptors returned by the select(2) system call. If S=0, the time limit expired. TIME INTERVAL(W) The elapsed time spent in the system call. A ‘W’ after the elapsed time indicates the process was scheduled out during this file activity. In this case, the elapsed time includes the wait time. PROCESS NAME The process that made the system call. Wide mode will append the thread id to the process name (i.e Mail.nnn).
By default the activity monitored includes all system processes except the running
fs_usage process, Terminal, telnetd, sshd, rlogind, tcsh, csh and sh.
These defaults can be overridden such that output is limited to include
or exclude a list of processes specified by the user.
Monitor all filesystem activity:
$ sudo fs_usage
[then ctrl-C to cancel]
Display file system related data for all instances of processes named Mail:
$ fs_usage -w -f filesys Mail
# Maximum data output will be displayed in the window.
“Whom the gods love dies young” ~ Menander 300 BC
ps - List running processes (returns PID).
top - List running processes.
sc_usage, latency, dyld.