I suspect it was a FILE_NOTIFY_CLOSE. Are you sure it isn't an auth event? Also, are you using separate es_client_t's for your notify and auth events? The timing issue I outlined is theoretically possible in both cases, but MUCH easier to do with auth events. It would be insightful to know if APFS triggers that or related ES events when decompressing a file. Open is what typically triggers decompression; however, in this case, revisiond was actually deleting a file (by calling remove on its path), so it's pretty likely that they had closed it just prior to the remove call. I will submit unified logs that cover the period in question, but your point remains. I'll try and take a look, but I'm not necessarily optimistic. Frankly, these issues generally have a high degree of uncertainty about them, so my comment there was really about acknowledging that reality. Not that our ES hooks are directly causing the deadlock, but that by hooking certain OS events and quickly acting on them, we're exerci
Topic:
App & System Services
SubTopic:
Core OS
Tags: