0

I want to understand iosnoop. Therefor I wrote a small program to trace on. I expect to see something in iosnoop if I flush the cache. I don't see anything until I kill the application. What am I doing wrong.

#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>
#include <sys/types.h>

int main(){
    pid_t pid = getpid();
    printf("pid: %lun", pid);

    FILE *file = fopen("hanswurst.txt", "a");

    while(1){
        fputs("Hello\n", file);
        fflush(file);
        sleep(1);
    }


    fclose(file);
    return 0;
}
Fachher
  • 28
  • 4

1 Answers1

1

It seems, at least on macOS, iosnoop only monitors OS I/O events to hardware. The fflush() call only flushes the C API file I/O buffer to the OS buffers, but until your file is closed, nothing is written to disk.

You could add a fsync(fileno(file)); after the fflush() to tell the OS to write its buffers to disk.

See https://stackoverflow.com/a/2340641 for details.

Alternatively, if you want to see what happens with the program without fsync(), you could use dtruss instead of iosnoop. It will show the system calls of your program while they are happening and will show the write calls to the OS.

tobiasfar
  • 51
  • 2