FS_USAGE(1)

👑 FS_USAGE — General Commands Manual, but make it fashion 💅

okay so bestie, gathering around because this one is literally about peeking at your system's filesystem activity in real-time. The command is fs_usage, and it's giving main character surveillance energy. You're gonna need root privileges for this because it uses the kernel tracing facility to operate — no cap, that's just how it is. 🔍✨

Think of it like this: by default, it monitors all system processes except the running fs_usage process itself, Terminal, telnetd, telnet, sshd, rlogind, tcsh, csh, sh, and zsh. But you can absolutely override these defaults so the output is limited to include or exclude whatever processes you want. You're in control, periodt. 💖

✨ SYNOPSIS ✨

fs_usage [-e] [-w] [-f mode] [-b] [-t seconds]
         [-R rawfile [-S start_time -E end_time]] [-F]
         [pid | cmd [pid | cmd [...]]]

🌸 DESCRIPTION 🌸

The fs_usage utility presents an ongoing display of system call usage information pertaining to filesystem activity. It requires root privileges due to the kernel tracing facility it uses to operate. By default, the activity monitored includes all system processes except the running fs_usage process, Terminal, telnetd, telnet, sshd, rlogind, tcsh, csh, sh, and zsh. These defaults can be overridden such that output is limited to include or exclude a list of processes specified by the user.

The output presented by fs_usage is formatted according to the size of your window. A narrow window will display fewer columns of data. Use a wide window for maximum data display. You may override the window formatting restrictions by forcing a wide display with the -w option. In this case, the data displayed will wrap when the window is not wide enough.

The options are as follows — get ready to screenshot this, it's a lot 🫶:

🎀 OPTIONS 🎀

• -e — Specifying the -e option generates output that excludes sampling of the running fs_usage tool. If a list of process IDs or commands is also given, then those processes are also excluded from the sampled output. It's giving "ignore these please" energy, and honestly? Respect. 💅
• -w — Specifying the -w option forces a wider, more detailed output, regardless of the window size. You're not letting a tiny window gatekeep your data. Iconic. 🔥
• -f — Specifying the -f option turns on output filtering based on the mode provided. Multiple filtering options can be specified. By default, no output filtering occurs. The supported modes are:
  • network — Network-related events are displayed. The way this one is always in the group chat even when you asked for a quiet night. 🌐
  • filesys — Filesystem-related events are displayed. The classic fs_usage experience, slay. 📁
  • pathname — Pathname-related events are displayed. It's giving "where exactly did you touch that file" investigative vibes. 🔎
  • exec — Exec and spawn events are displayed. New processes popping off left and right. 🐣
  • diskio — Disk I/O events are displayed. Your disk is doing cardio and this shows the receipts. 💾
  • cachehit — In addition, show cache hits. Not just misses, bestie — we're showing the hits too. 🎯
• -b — Specifying the -b option annotates disk I/O events with BootCache info (if available). Little bonus context, we love to see it. 🎁
• -t seconds — Specifies a run timeout in seconds. fs_usage will run for no longer than the timeout specified. Time-boxed and thriving. ⏱️
• -R raw_file — Specifies a raw trace file to process. Reliving the past, but make it filesystem. 🗂️
• -S start_time — If -R is selected, specifies the start time in microseconds to begin processing entries from the raw trace file. Entries with timestamps before the specified start time will be skipped. No time-traveling backwards, bestie. ⏳
• -E end_time — If -R is selected, specifies the ending time in microseconds to stop processing entries from the raw trace file. Entries with timestamps beyond the specified ending time will be skipped. We're closing the curtain at this timestamp. 🎬
• -F — Specifying the -F option trims pathnames from the right side, keeping the front of the pathname. By default, pathnames are trimmed from the left side. It's giving "keep the start of the story" energy. 📖
• pid | cmd — The sampled data can be limited to a list of process IDs or commands. When a command name is given, all processes with that name will be sampled. Using the -e option has the opposite effect, excluding sampled data relating to the given list of process IDs or commands. So you can either let them in or shut the door, your call. 🚪

🦋 THE DATA COLUMNS 🦋 (aka the lore of the output)

okay so when the output starts rolling, here's what all of it means — no cap, this is the translation guide:

• TIMESTAMP — TOD when call occurred. Wide mode will have microsecond granularity. So you'll know exactly when things went down. Precise queen behavior. 🕰️
• CALL — The name of the network or filesystem related call, page-in, page-out, or physical disk access. The actual noun of the operation. 📣
• FILE DESCRIPTOR — Of the form F=x, x is a file descriptor. Depending on the type of system call, this will be either an input value or a return value. It's giving "here's your file's social security number" energy. 🔢
• BYTE COUNT — Of the form B=x, x is the number of bytes requested by the call. Data movers, we stan. 📏
• [ERRNO] — On error, the errno is displayed in brackets. So when things go wrong, it's literally right there in square brackets. No hiding. 💀
• PATHNAME — Pathname of the file accessed (up to the last 28 bytes). We've got limited space, bestie — 28 bytes of pathname fame. 📂
• FAULT ADDRESS — Of the form A=0xnnnnnnnn, where 0xnnnnnnnn is the address being faulted. Hex girls stay winning. 🧚
• DISK BLOCK NUMBER — Of the form D=0xnnnnnnnn, where 0xnnnnnnnn is the block number of the physical disk block being read or written. Physical location of the drama. 🧱
• OFFSET — Of the form O=0xnnnnnnnn, where 0xnnnnnnnn is a file offset. Exactly where in the file we're hanging out. 📌
• SELECT RETURN — Of the form S=x, x is the number of ready descriptors returned by the select(2) system call. If S=0, the time limit expired. So S=0 means the vibe check came back empty, oop. ⏰
• TIME INTERVAL(W) — The elapsed time spent in the system call. A 'W' after the elapsed time indicates the process was scheduled out during this file activity. In this case, the elapsed time includes the wait time. So the clock is counting the nap too. 😴
• PROCESS NAME — The process that made the system call. Wide mode will append the thread id to the process name (i.e Mail.nnn). Now you know exactly which process pulled up to the function. 💌

🌈 SAMPLE USAGE 🌈

okay here's a little example to visualize it:

fs_usage -w -f filesys Mail

fs_usage will display file system related data for all instances of processes named Mail. Maximum data output will be displayed in the window. It's giving "head empty, just Mail process filesystem activity" and we love that for us. 💌✨

💡 lowkey reminder bestie: this tool needs root privileges. don't forget or it's not gonna have the range to do its thing. 🫶

🔗 SEE ALSO 🔗

dyld(1), latency(1), sc_usage(1), top(1) — go check these out too when you're done obsessing over this one. 💖

and that's the whole page, bestie! you're now academically and vibally educated on fs_usage. 💅

This iconic manual lives in macOS land, dated November 7, 2002, and it's registered as FS_USAGE(1) in the General Commands Manual section. Periodt. 🫶💖✨