MacOS – fs_usage returns a LOT of ioctl lines

filesystemmacosterminal

I've been reading up on interesting Terminal commands (I've used it forever, but there's always more to learn) when I ran across this. I ran sudo fs_usage and got a whole lot of this:

...
13:39:09  ioctl                   0.000019   WindowServer
13:39:09  ioctl                   0.000017   WindowServer
13:39:09  ioctl                   0.000020   WindowServer
13:39:09  ioctl                   0.000018   WindowServer
...

I figure, if I ever actually need to use this, it would be nice to have a way not only to filter out filesystem activity related to the WindowServer, in particular, but other processes as well. It would also be nice to specify a service or process for which to return information.

Have I misread the usefulness of this function? Is there a way to get rid of those numerous WindowServer calls? Can I specify the processes in which I'm interested?

Best Answer

All that is possible by using fs_usage with several options. You may also pipe it to grep to further restrict the output.

To exclude a process or a pid (and also fs_usage itself) use the -e option:

sudo fs_usage -e WindowsServer
sudo fs_usage -e 123

Specifying the -f option turns on output filtering based on the mode provided. The possible modes are: 

network    Network-related events are displayed.  
filesys    Filesystem-related events are displayed.  
pathname   Pathname-related events are displayed.  
exec       Exec and spawn events are displayed.  
diskio     Disk I/O events are displayed.  
cachehit   In addition, show cache hits.

Example: 

sudo fs_usage -e WindowsServer -f filesys

To just show a special pid/command and exclude all other, use the pid (enter ps aux to get it) or the name of the command or application

Examples:

sudo fs_usage -f filesys Terminal
sudo fs_usage -f filesys 178

A different possibility is to pipe the output of fs_usage to grep:

sudo fs_usage -e -f filesys|grep Terminal
sudo fs_usage -e -f filesys|grep -v grep|grep write
sudo fs_usage -e|grep -v grep|grep -v WindowsServer|grep ioctl

The part grep -v grep or grep -v WindowsServer excludes "grep" and/or "WindowsServer" from occurring in the result.

Sources:
Apple developer
Rentzsch

Related Question