One Quickie

---

Seeing what time machine is looking at (DTrace->General)

Curious what Time Machine is looking at while doing backups? This one-liner will show all of the files that are being opened:

sudo dtrace -q -n 'syscall::open*:entry/execname=="backupd"/ { self->name = arg0; }' -n 'syscall::open*:return/execname=="backupd"/ { printf ( "%s opening %s\n ", execname, copyinstr(self->name)) ; self->name = 0}'

Or in a more readable form:

syscall::open*:entry
/execname=="backupd"/
{
    self->name = arg0;
}

syscall::open*:return
/execname=="backupd"/
{
    printf ( "%s opening %s\n", execname, copyinstr(self->name));
    self->name = 0;
}

Note that FileValue will cause errors of the kind "invalid user access in action #2 at DIF offset 24". I don't know how to work around that.