|
fs_usage Intro
A friend of mine recently asked where Mac OS X's system-wide spell checker stores user-added words. I didn't know the answer (~/Library/Spelling/en for English words), but I did know how to find the answer: Mac OS X's little-known fs_usage command.
fs_usage is a command line tool that displays file system activity. This is useful in a variety of circumstances. For example, a while back another friend was having problem with Eudora crashing. Using fs_usage, we discovered that Eudora would crash after reading a certain file. Restoring that file from backup solved the problem. Here, fs_usage really saved the day since the crash logs were not helpful and Eudora gave no other indication of what went wrong.
If you want to drink from the fire hose, invoke fs_usage directly:
$ sudo fs_usage
Soon your terminal window will be filled with CACHE_HIT log entries, which aren't all that interesting. So let's pair down the output a little. First, include the -e switch, which instructs fs_usage not to include itself in its own output. Second, limit the output to only the file system using the -f filesys:
$ sudo fs_usage -e -f filesystem
That's a little better, but still a firehose. You can cut it down by grepping out the CACHE_HIT lines and grep's own reads:
$ sudo fs_usage -e -f filesystem|grep -v CACHE_HIT|grep -v grep
Now you have a solid base. It's still a lot of information delivered pretty quickly, but now it's realistic to -- say -- start the recording, do your thing, stop the recording and comb through the resulting logs.
Of course, you can further focus the output. For example, discover what files are being opened, as they're being opened:
$ sudo fs_usage -e -f filesystem|grep -v CACHE_HIT|grep -v grep|grep open
Or, who's writing to your disk:
$ sudo fs_usage -e -f filesystem|grep -v CACHE_HIT|grep -v grep|grep write
Now that you're acquainted with fs_usage, I'll clue you in how I figured out where the spell checker stores its user word list. First I did a general capture, typing "xyzzy" into TextEdit, invoking the spell checker and hitting the "Learn" button. I stopped the capture, and looked at all the activity. I discovered AppleSpell did a little IO. That was promising, but it still didn't tell me which file. So I killed AppleSpell and started logging file open requests. I performed another spell check in TextEdit, and sure enough AppleSpell was relaunched on my behalf, and I saw it opened ~/Library/Spelling/en.
Friday, October 22, 2004
12:00 AM
|
