Following the topic of intercepting file access events: could you suggest other technologies that are better suited to achieve this goal? So, I think the big question here is what are you actually trying to do“? The core problem here is that: Read I/O is REALLY frequent, so the system doesn't want to do anything that would make it slower/more complicated. Memory mapping makes the idea of tracking reads somewhat... questionable. As the most extreme example of this, take the file that's the backing libsystem.dylib. EVERY (yes, EVERY) process in the system has mapped it into memory and is accessing it very frequently. Tying any I/O activity on that file to any specific process isn't really possible or meaningful. Even if you could track actual I/O activity (meaning, read from disks) and tie it to a particular process, all that would tell you is which process happened to ask for a page I didn't have. It wouldn't tell you anything about the other X processes that accessed the data directly from VM without
Topic:
App & System Services
SubTopic:
Core OS
Tags: