I would like to know which process has created files on os X 10.6. I'm trying DTrace, which probably will give the right answer, but I have not eyes to see the method. I'm doing this because I think some oddities are happening with the Flash plugin, and triggering spotlight.
Asked
Active
Viewed 185 times
2
-
See also: http://unix.stackexchange.com/questions/13776/determine-which-process-is-creating-a-file – Michael Mrozek Jul 20 '11 at 15:09
-
auditctl might be the way... looking into it thx – chiggsy Jul 21 '11 at 09:37
1 Answers
1
Would lsof help? If the file is still open, you can see who has it open. Also very useful when you get "device or resource busy" errors.
Aaron D. Marasco
- 5,758
-
No, lsof is not the way. See, I might come across a strange file, and wonder how it got there. DTrace is fine for the actual opening when it's open. But when I sit down and say "hmm where did this 'always_watchin_you.sol' file come from?", all i get is that it's my UID. – chiggsy Jul 17 '11 at 10:56