Message283047
I thought I was on to something when I found this technique for using dtrace to detect a file deletion: https://blogs.oracle.com/zoneszone/entry/who_keeps_removing_that_file
However, I don't seem to have privilege to run it.
$ cat trap-aliases-delete
#! /usr/sbin/dtrace -wqs
syscall::unlinkat:entry
/cleanpath(copyinstr(arg1)) == "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/encodings/aliases.py"/
{
stop();
printf("%s[%d] caught removing aliases.py\n", execname, pid);
system("ptree %d; pstack %d; prun %d", pid, pid, pid);
}
$ sudo ./trap-aliases-delete
dtrace: system integrity protection is on, some features will not be available
dtrace: could not enable tracing: Permission denied |
|
Date |
User |
Action |
Args |
2016-12-12 21:19:08 | jaraco | set | recipients:
+ jaraco, ned.deily |
2016-12-12 21:19:08 | jaraco | set | messageid: <1481577548.75.0.840410769991.issue28949@psf.upfronthosting.co.za> |
2016-12-12 21:19:08 | jaraco | link | issue28949 messages |
2016-12-12 21:19:08 | jaraco | create | |
|