Hi folks, does anyone know how to use use ktrace/kdump combination to react to some system calls? For example, I want to be informed if some program creates a directory on the disk…- BobC
You don’t want to use ktrace and friends for this. ktrace produces very voluminous output in an undocumented format, so you’d need to have kdump process that for you, which will end up being a CPU and disk intensive task. Take a look at kqueue : http://people.freebsd.org/~jlemon/papers/kqueue.pdf, and check cocoa.mamasam.com for some postings related to kqueue.
See: http://developer.apple.com/samplecode/FileNotification/FileNotification.html which uses the kqueue method.