Author jaraco
Recipients jaraco, ned.deily
Date 2016-12-12.21:19:08
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1481577548.75.0.840410769991.issue28949@psf.upfronthosting.co.za>
In-reply-to
Content
I thought I was on to something when I found this technique for using dtrace to detect a file deletion: https://blogs.oracle.com/zoneszone/entry/who_keeps_removing_that_file

However, I don't seem to have privilege to run it.

$ cat trap-aliases-delete 
#! /usr/sbin/dtrace -wqs

syscall::unlinkat:entry
/cleanpath(copyinstr(arg1)) == "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/encodings/aliases.py"/
{
        stop();
        printf("%s[%d] caught removing aliases.py\n", execname, pid);
        system("ptree %d; pstack %d; prun %d", pid, pid, pid);
}
$ sudo ./trap-aliases-delete
dtrace: system integrity protection is on, some features will not be available

dtrace: could not enable tracing: Permission denied
History
Date User Action Args
2016-12-12 21:19:08jaracosetrecipients: + jaraco, ned.deily
2016-12-12 21:19:08jaracosetmessageid: <1481577548.75.0.840410769991.issue28949@psf.upfronthosting.co.za>
2016-12-12 21:19:08jaracolinkissue28949 messages
2016-12-12 21:19:08jaracocreate