Real time application and routine sequencing

ByMike Moffit

Terminal and application tracking

We have previously covered trace, dynamic trace scripting, in Terminal and the higher powered logging and tracking it provided with the iosnoop command. Dtrace though offers realtime IO tracking of everything from read and write functions of the HD, system calls and application launch and exit.
Do you want to see what processes and applications are opening and closing in real time? execsnoop is the terminal command that logs all applications and routines as the launch. execsnoop tracks the applications by User ID, UID, that opened the application; PID or process ID of routine or application as it launches sequentially, and the audit PPID, Parent process ID, what application/routine spawned the new process and finally the ARGS or name of the process or application.
UID PID PPID ARGS

0 53624 1 ocspd
501 53625 181 AddressBookManag
501 53626 53625 AddressBookSync
501 53627 27 SFLSharedPrefsTo
0 53628 1 newsyslog
501 53629 181 Safari
501 53630 27 SFLIconTool

In the above example, UID, 0 or 501, root or the User ID of the Admin account on the machine is the UID making the request for the opening of the new process. As each new routine or application launches, it spawns a process ID, 53624, etc.; The PPID reflects the Parent PID or the new PID; finally the application or process name.
Why is this important? Using this Terminal command you can see applications that may be causing issues for your system. If an application or routine regularly launches and fails, reoccurs frequently, this may indicate that the particular application is misbehaving and causing your system problems.

Similar Posts

  • Complex Problems Often Have Simple Solutions

    A long time ago while working for Radio Shack, a co-worker gave me a series of motivational tapes by Joel Weldon. One of the more important passages began with “Elephants don’t bite”–the big things usually aren’t what get you. Typically it’s the gnats, the horse flies, the bees, the mosquitoes–tiny as they are, they can be quite annoying. The little, seemingly insignificant things can cause more problems than one would think. Over my first few weeks as a tech here at Small Dog, I have learned that you can never overlook or discount the little things.

    Sure, that sounds great, but how does that help someone who is trying to troubleshoot a computer with a nagging problem? One way is to take your large problem (it doesn’t boot and I have homework to do!) and break it down into a series of smaller, simpler possibilities.

    We all laugh when we read the tech support horror stories about the guy who spent two hours troubleshooting a computer only to find that it wasn’t plugged in, hence the reason that obvious question is always asked first when you call for help. Techs I have worked with over the years absolutely hate it when I suggest obvious solutions, but I do it because sometimes the answer is so obvious we skipped over it because it was so simple. We get so used to dealing with difficult problems with complex solutions that we forget to try the quick fixes first. Before cracking the case to test a suspected faulty power supply, check the easy (small) things such as plugging something else into the wall outlet or the power strip to make sure that works. Power strips are designed to fail before the equipment plugged into it, so it is entirely possible that a brownout could have taken it right out. It’s a quick and cheap fix if that’s what happened, so it makes sense to try it first.

    Another example from an incident that happened this week in Manchester: you have a MacBook that won’t recognize the hard disk. Disk Utility will not mount it, and may not even see it at all. The assumption? Dead hard drive. So you pull it out and replace it, fire up the OS X Install DVD, and the drive isn’t recognized. Pull the new drive out, plug it into an external connector and it works. Okay, maybe the drive is flaky, so try another drive…and the same thing happens. Given this, what’s the next thing to replace? The logic board? Costly, and time consuming. By now, perhaps some have already screamed out the answer: a bad connector cable. A seemingly minor thing that is often overlooked because, well, it’s just a cable, so what could go wrong with it?

    Take care of the small things, and the big ones often take care of themselves.

  • Jon

    Simple steps for resolving and diagnosing simple (non) boot issues. In the past week we have, in the Waitsfield service area, received no…