I want to understand iosnoop. Therefor I wrote a small program to trace on. I expect to see something in iosnoop if I flush the cache. I don't see anything until I kill the application. What am I doing wrong.
#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>
#include <sys/types.h>
int main(){
pid_t pid = getpid();
printf("pid: %lun", pid);
FILE *file = fopen("hanswurst.txt", "a");
while(1){
fputs("Hello\n", file);
fflush(file);
sleep(1);
}
fclose(file);
return 0;
}
It seems, at least on macOS, iosnoop
only monitors OS I/O events to hardware. The fflush()
call only flushes the C API file I/O buffer to the OS buffers, but until your file is closed, nothing is written to disk.
You could add a fsync(fileno(file));
after the fflush()
to tell the OS to write its buffers to disk.
See https://stackoverflow.com/a/2340641 for details.
Alternatively, if you want to see what happens with the program without fsync()
, you could use dtruss
instead of iosnoop
. It will show the system calls of your program while they are happening and will show the write
calls to the OS.