Search code examples
macosiotraceiokitdarwin

Can you trace I/O activity for a process on MacOS?


Does MacOS have a utility/command for tracing I/O activity (e.g. via IOKit) for a process for debugging purposes?

There exists tools for network, syscall, etc. activity but I can't find any information for how to find which devices a specific process is currently using, for example. Is this even possible with Darwin?


Solution

  • It's not exactly tracing, but you can view an IOKit service object's user clients (represented by IOUserClient objects) using ioreg (CLI) or IORegistryExplorer.app (GUI, from Xcode Additional Tools package) or IOJones.app (open source GUI). This will tell you which processes are connected to an IOService at a given time, although it may be difficult to see short-lived connections.

    I'm not aware of a pre-made tracing tool, but it should be possible to write your own dtrace script which does this. Note that IOKit calls are not syscalls but use Mach messaging, so your best bet is probably to trace the kernel equivalents of the various IOConnectCall*() family of functions and similar. I've been meaning to write something like this myself but thus far haven't had a chance to do so. (I did update dtruss to be a lot more useful on macOS than the version that ships with the OS a while back but dtruss doesn't help with IOKit unfortunately.)