Track an applications usage in Mac OS X with opensnoop

track mac application usage

Using the command line tool ‘opensnoop’ you can track any Mac applications (or system process) usage of the file system. This is a very handy tool for administrators and troubleshooting! The simplest way to use it is as follows:

sudo opensnoop -n Safari

You can also track a specific file, and what is accessing it, like so:

sudo opensnoop -f /etc/hosts

Tracking a specific process is as simple as just specifying the process id:

sudo opensnoop -p PID

opensnoop will keep tracking the file until the process itself is ended, so just hit Control-C in the Terminal to stop opensnoop from running. In case you’re wondering, opensnoop is based on DTrace, a popular UNIX tool.

The uses are infinite, give it a try, or read more about opensnoop

Run full OS X installer for another drive without rebooting

If you ever need to install (or reinstall) OS X on a drive other than your current boot drive, you can do it without rebooting. (Normally, when you launch the OS X installer, it reboots your machine before starting the installation.) With this hint, you can do the whole install process while booted normally from your current drive -- so you can keep working while the install is going on.

To do that, just launch the Unix executable for the installer application on the DVD, by running the following command in Terminal:

sudo /Volumes/Snow\ leopard\ Install\ DVD/System/Installation/CDIS/Mac\ OS\ X\ Installer.app/Contents/MacOS/Mac\ OS\ X\ Installer

To make it work even faster, you can clone the install DVD to a small partition on one of your drives, and then modify the above command to point to the path to the installer application on that partition.

Set time of deletion for files placed in the Trash

To make it easier to retrieve accidentally-deleted items from the trash, you can use an Automator workflow and the third-party Automator action Touch Files to create a "date deleted" time stamp on files placed in the trash. Here’s how:

  1. Download the Automator action and unzip it.
  2. Open Automator and import this action (File » Import Actions and navigate into the Touch Files folder to find the Action).
  3. Create a new Folder Action workflow in Automator.
  4. Click the Choose Folder pop-up at the top of the workflow, and select Other. When the file choice dialog appears, type Shift-Command-G, then type ~/.Trash/ and click Choose.
  5. Drag the Touch Files action (you can find it under Files & Folders) into your workflow. I recommend checking the Apply to contents of folders option, otherwise if you delete a folder, its files’ modification date will remain unchanged.
  6. Save the Folder Action with a relevant name (Set Modification Date or whatever).

Now when you add a file to the Trash, its modification date will change. Sort the Trash window by date modified, and your most recently deleted files will be at the top.

Just make sure you give the workflow a second or two to run before checking the modification date. It worked on both files and folders with the option checked as described above. This is a nice solution to finding the most-recent of multiple similar/identical files you’ve deleted. One caveat: this will only work for files you delete from your boot drive; if you have other drives connected, items deleted from those drives actually go into a different folder (/Volumes/volume_name/.Trashes/501).

Re-enable Java 1.4.2 and Java 1.5 apps in Snow Leopard

Many applications that relied on Java 1.4.2 and Java 1.5 stopped working in Snow Leopard, because Apple removed these Java versions from the system. Upgrading to the lastest versions of many applications usually will solve the problem. However, your favorite application may not have a Snow Leopard compatible upgrade. For these applications, re-installing Java 1.4.2 and/or Java 1.5 is necessary. Sometimes, even this is not enough. As an example, Apple also removed the Cocoa-Java bridge from Snow Leopard, which some Java applications such as PDFLab depended on. Reinstalling the Cocoa-Java bridge along with the proper version of Java is necessary to re-enable these applications on Snow Leopard. For example, getting PDFLab working again in Snow Leopard requires reinstalling Java 1.4.2 and the Cocoa-Java bridge. Read on for a how-to...

Installing Java 1.4.2 and/or Java 1.5 on snow Leopard:

The following is based on two blog posts: Using Java 1.5 and Java 1.4 on Snow Leopard and Installing Java 1.5 on Snow Leopard:

  1. Download the official Java package from Apple: Java for Mac OS X 10.5 Update 4, dated June 15, 2009.
  2. Use the excellent shareware utility Pacifist to open the downloaded JavaForMacOSX10.5Update4.pkg file.
  3. First use Finder to go to System » Library » Frameworks » JavaVM.framework » Versions and delete the two aliases (symlinks) 1.5 and 1.5.0. Don’t skip this step, because otherwise the extraction will follow the symlinks and overwrite the contents of the 1.6.0 folder, oops!
  4. In Pacifist, drill down into Contents » System » Library » Frameworks » JavaVM.framework » Versions.
  5. In Pacifist, select 1.5 and 1.5.0, Control-click on the selection, and chose Install to Default Location from the pop-up menu.
  6. In the instructions above, the same applies for version 1.4.2.

Installing the Cocoa-Java Bridge:

This is based on Getting back the Cocoa-Java bridge in Snow Leopard:

Copy from a working Leopard (10.5) installation the following folders:

  1. the com directory in /System/Library/Java
  2. the eight files ending with .dylib in /usr/lib/java (four of these are regular files, the other four are symlinks; if you prefer, you can copy just the files and recreate the symlinks by hand).

Add Quick Look support for WordPerfect form files

OpenOffice will open WordPerfect files, regardless of their extension. Quick Look will allow you to preview .wpd files, as long as you have the WordPerfect.qlgenerator package installed in /Library/Quicklook. However, one cannot Quick Look Wordperfect files with other extensions, such as .frm, which is a name given to Wordperfect form files.

In order to make Quick Look recognize the .frm file type, control-click on the OpenOffice.org.app and select Show Package Contents from the pop-up menu. In the Contents folder, double-click the Info.plist file (assuming you have XCode installed). Add a new child under the Exported Type UTIs key. Enter the following information (some of the keys will be there by default, others you will need to enter manually):

  • Conforms to UTIs (array)
    •  Item 0 (string): com.corel.wordperfect.doc
  • Identifier (string): com.corel.wordperfect.frm
  • Equivalent Types (array)
    •  public.mime-type (array)
      —  Item 0 (string): application/vnd.sun.xml.writer
    •  public.filename-extension (array)
      —  Item 0 (string): frm

If you’re working with an editor that edits raw plist files instead of Property List Editor’s pretty version, here’s how the above would look:

<dict>
  <key>UTTypeConformsTo</key>
  <array>
    <string>com.corel.wordperfect.doc</string>
  </array>
  <key>UTTypeIdentifier</key>
  <string>com.corel.wordperfect.frm</string>
  <key>UTTypeTagSpecification</key>
  <dict>
    <key>public.mime-type</key>
    <array>
      <string>application/vnd.sun.xml.writer</string>
    </array>
    <key>public.filename-extension</key>
    <array>
      <string>frm</string>
    </array>
  </dict>
</dict>

Save Info.plist, open a Terminal window, and type touch /Applications/OpenOffice.org.app/. Your .frm Wordperfect files should now be previewable in Quick Look.

Linux how to: Accessing documentation

Linux, like Unix, is a self-documenting system, with man pages accessible through the man command. But Linux also offers many other helpful commands for accessing its documentation. You can use the apropos command--for example, with a keyword such as partition--to find commands related to partitioning, like this: 

$ apropos partition
diskdumpfmt          (8)  - format a dump device or a partition 
fdisk                (8)  - Partition table manipulator for Linux 
GNU Parted [parted]  (8)  - a partition manipulation program 
mpartition           (1)  - partition an MSDOS hard disk 
MPI_Cart_sub         (3)  - Partitions a communicator into subgroups which form  
                            lower-dimensional cartesian subgrids 
partprobe            (8)  - inform the OS of partition table changes 
pvcreate             (8)  - initialize a disk or partition for use by LVM 
sfdisk               (8)  - Partition table manipulator for Linux

To find a command and its documentation, you can use the whereis command. For example, if you are looking for the fdisk command, you can do this:

$ whereis fdisk

fdisk: /sbin/fdisk /usr/share/man/man8/fdisk.8.gz

Using Man Pages

To learn more about a command or program, use the man command, followed by the name of the command. Man pages for Linux and X Window commands are within the /usr/share/man, /usr/local/share/man, and /usr/X11R6/man directories; so, for example, to read the rm command’s man page, use the man command like this:

$ man rm

After you press Enter, the less command (a Linux command known as a pager) displays the man page. The less command is a text browser you can use to scroll forward and backward (even sideways) through the document to learn more about the command. Type the letter h to get help, use the forward slash / to enter a search string, or press q to quit.

Note

Although nearly all the hundreds of GNU commands included with Linux each have a man page, you must use the info command to read detailed information about using a GNU command. For example, to learn even more about bash (which has a rather extensive manual page), use the info command like this:

$ info bash

Press the n and p keys to navigate through the document, or scroll down to a menu item on the screen and press Enter to read about a specific feature. Press q to quit reading.

by Matthew Helmke

«Previous Page | Next Page»