How to use Macintosh fs_usage command line to trace SEP file activity
Article ID: 178269
Updated On:
Products
Endpoint Protection
Issue/Introduction
Resolution
From Macintosh Terminal application's command line:
sudo -b fs_usage -w -f pathname SymDaemon > ~/Desktop/symdaemon.log
This will run fs_usage in the background, logging all SymDaemon operations involving file pathnames. Double-click symdaemon.log on the Desktop and you can view its contents in realtime using the Macintosh Console application. It may be helpful to choose "Wrap Lines at Line Breaks" from View menu and close / re-open the log. The Macintosh Console app can also filter your view of any log to include only those lines that match strings in the "Filter" text area at upper-right of window. You can also save filtered views into a new log file. For example, if you want a record only of all open operations for eicar test files, type "open eicar" into Filter.
While fs_usage is running, you can empty and restart the log file by typing the following into the Terminal command line:
> ~/Desktop/symdaemon.log
When you are ready to stop logging, type:
sudo killall fs_usage
Below is an example log file from an idle Macintosh, filtered to show open operations only. Auto-Protect scanning of compressed files is enabled.
13:02:34.268072 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008E.tok 0.000070 SymDaemon.949 13:02:34.268108 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008E.tok 0.000028 SymDaemon.949 13:02:39.034659 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000016 SymDaemon.950 13:02:39.035545 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:39.036117 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:39.036208 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:39.036437 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008F.tok 0.000051 SymDaemon.949 13:02:39.036469 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008F.tok 0.000026 SymDaemon.949 13:02:41.235027 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000026 SymDaemon.950 13:02:41.235919 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:41.236492 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:41.236562 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:41.236763 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000090.tok 0.000062 SymDaemon.949 13:02:41.236795 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000090.tok 0.000026 SymDaemon.949 13:02:51.280318 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data 0.000025 SymDaemon.950 13:02:51.283946 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist 0.000014 SymDaemon.950 13:02:51.286407 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data 0.000013 SymDaemon.949 13:02:51.289351 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data 0.000013 SymDaemon.949 13:02:51.289862 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000091.tok 0.000062 SymDaemon.949 13:02:51.289908 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000091.tok 0.000038 SymDaemon.949 13:02:51.305457 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist 0.000015 SymDaemon.949 13:02:51.308111 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist 0.000013 SymDaemon.949 13:02:51.308374 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000092.tok 0.000053 SymDaemon.949 13:02:51.308406 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000092.tok 0.000025 SymDaemon.949 13:03:05.473887 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000024 SymDaemon.950 13:03:05.475173 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.950 13:03:05.477793 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:03:05.478664 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:03:05.478874 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000093.tok 0.000073 SymDaemon.949 13:03:05.478908 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000093.tok 0.000026 SymDaemon.949 13:03:05.481241 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000012 SymDaemon.949 13:03:05.483928 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.949 13:03:05.484168 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000094.tok 0.000046 SymDaemon.949 13:03:05.484199 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000094.tok 0.000024 SymDaemon.949 13:03:06.547550 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000024 SymDaemon.950 13:03:06.548448 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000013 SymDaemon.949 13:03:06.549029 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000012 SymDaemon.949 13:03:06.549236 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000095.tok 0.000061 SymDaemon.949 13:03:06.549270 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000095.tok 0.000026 SymDaemon.949 13:03:12.057672 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist 0.000025 SymDaemon.950 13:03:12.058693 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist 0.000013 SymDaemon.949 13:03:12.059341 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist 0.000012 SymDaemon.949 13:03:12.059637 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000096.tok 0.000063 SymDaemon.949 13:03:12.059671 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000096.tok 0.000026 SymDaemon.949 13:03:30.193070 open F=21 (R_____) /private/var/db/locationd/clients.plist 0.000030 SymDaemon.950 13:03:30.194220 open F=21 (R_____) /private/var/db/locationd/clients.plist 0.000013 SymDaemon.949 13:03:30.194805 open F=21 (R_____) /private/var/db/locationd/clients.plist 0.000012 SymDaemon.949 13:03:30.195009 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000097.tok 0.000068 SymDaemon.949 13:03:30.195043 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000097.tok 0.000027 SymDaemon.949 13:03:32.795182 open F=21 (R_____) /Applications/Safari.app 0.000023 SymDaemon.8195 13:03:32.795282 open F=21 (R_____) /Applications/Safari.app/Contents 0.000020 SymDaemon.8195 13:03:32.795390 open F=21 (R_____) /Applications/Safari.app/Contents/Info.plist 0.000026 SymDaemon.8195 13:03:32.795903 open F=21 (R_____) /Applications/Safari.app/Contents/PkgInfo 0.000039 SymDaemon.8195 13:03:33.937837 open F=21 (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework 0.000010 SymDaemon.8195 13:03:33.937960 open F=21 (R_____) A/Resources 0.000016 SymDaemon.8195 13:03:33.938056 open F=21 (R_____) A/Resources/Info.plist 0.000027 SymDaemon.8195 13:03:33.938489 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/Contents>>>>>>>>>>>>>>>>>>>>> 0.000015 SymDaemon.8195 13:03:33.938511 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support Files>>>>>>>>>>>>>>>> 0.000012 SymDaemon.8195 13:03:33.938531 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/PkgInfo 0.000012 SymDaemon.8195 13:03:35.746456 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000026 SymDaemon.950 13:03:35.748028 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000014 SymDaemon.950 13:03:35.750901 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000025 SymDaemon.950 13:03:35.751844 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.950 13:03:35.752813 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:03:35.753820 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:03:35.754242 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000098.tok 0.000065 SymDaemon.949 13:03:35.754277 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000098.tok 0.000026 SymDaemon.949 13:03:35.757266 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.949 13:03:35.760008 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.949 13:03:35.760275 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000099.tok 0.000050 SymDaemon.949 13:03:35.760307 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000099.tok 0.000025 SymDaemon.949 13:03:35.760954 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000013 SymDaemon.949 13:03:35.761856 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000012 SymDaemon.949 13:03:35.762240 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009A.tok 0.000040 SymDaemon.949 13:03:35.762270 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009A.tok 0.000024 SymDaemon.949 13:03:35.766091 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.949 13:03:35.767116 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000012 SymDaemon.949 13:03:35.767614 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009B.tok 0.000056 SymDaemon.949 13:03:35.767645 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009B.tok 0.000024 SymDaemon.949 13:03:36.772356 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000020 SymDaemon.950 13:03:36.773550 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000013 SymDaemon.949 13:03:36.774185 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000014 SymDaemon.949 13:03:36.774466 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009C.tok 0.000073 SymDaemon.949 13:03:36.774504 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009C.tok 0.000029 SymDaemon.949 13:03:40.309272 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data 0.000025 SymDaemon.950 13:03:40.311591 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist 0.000014 SymDaemon.950 13:03:40.332034 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data 0.000018 SymDaemon.949 13:03:40.332930 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data 0.000013 SymDaemon.949 13:03:40.333223 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009D.tok 0.000062 SymDaemon.949 13:03:40.333256 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009D.tok 0.000026 SymDaemon.949 13:03:40.334365 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist 0.000013 SymDaemon.949 13:03:40.341578 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist 0.000016 SymDaemon.949 13:03:40.341878 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009E.tok 0.000057 SymDaemon.949 13:03:40.341925 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009E.tok 0.000026 SymDaemon.949 13:03:40.841251 open F=21 (R_____) /Applications/iTunes.app 0.000022 SymDaemon.8195 13:03:40.841364 open F=21 (R_____) /Applications/iTunes.app/Contents 0.000020 SymDaemon.8195 13:03:40.841468 open F=21 (R_____) /Applications/iTunes.app/Contents/Info.plist 0.000026 SymDaemon.8195 13:03:40.842240 open F=21 (R_____) /Applications/iTunes.app/Contents/PkgInfo 0.000024 SymDaemon.8195 13:03:42.216811 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000015 SymDaemon.950 13:03:42.222765 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000013 SymDaemon.949 13:03:42.229259 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000014 SymDaemon.949 13:03:44.389992 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000212 W SymDaemon.950 13:03:44.392944 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000014 SymDaemon.950 13:03:44.395188 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data 0.000015 SymDaemon.950 13:03:44.395885 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist 0.000013 SymDaemon.950 13:03:44.396224 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000013 SymDaemon.949 13:03:44.397107 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000013 SymDaemon.949 13:03:44.397527 open F=23 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009F.tok 0.000061 SymDaemon.949 13:03:44.397561 open F=23 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009F.tok 0.000027 SymDaemon.949 13:03:44.427401 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000015 SymDaemon.949 13:03:44.428513 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.949 13:03:44.429012 open F=23 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A0.tok 0.000052 SymDaemon.949 13:03:44.429044 open F=23 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A0.tok 0.000025 SymDaemon.949 13:03:44.447497 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000016 SymDaemon.950 13:03:44.460196 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data 0.000016 SymDaemon.949 13:03:44.461007 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data 0.000013 SymDaemon.949 13:03:44.461170 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A1.tok 0.000048 SymDaemon.949 13:03:44.461202 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A1.tok 0.000025 SymDaemon.949 13:03:44.491527 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist 0.000015 SymDaemon.949 13:03:44.573513 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist 0.000016 SymDaemon.949 13:03:44.573775 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A2.tok 0.000058 SymDaemon.949 13:03:44.573809 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A2.tok 0.000026 SymDaemon.949 13:03:44.574809 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:44.575883 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:44.576252 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A3.tok 0.000042 SymDaemon.949 13:03:44.576283 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A3.tok 0.000025 SymDaemon.949 13:03:45.729595 open F=21 (R_____) /Users/admin/Library/Safari/TopSites.plist 0.000018 SymDaemon.950 13:03:45.730511 open F=21 (R_____) /Users/admin/Library/Safari/LastSession.plist 0.000013 SymDaemon.950 13:03:45.731245 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.950 13:03:45.731984 open F=21 (R_____) /Users/admin/Library/Safari/TopSites.plist 0.000012 SymDaemon.949 13:03:45.732597 open F=21 (R_____) /Users/admin/Library/Safari/TopSites.plist 0.000012 SymDaemon.949 13:03:45.732782 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A4.tok 0.000059 SymDaemon.949 13:03:45.732815 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A4.tok 0.000026 SymDaemon.949 13:03:45.733356 open F=21 (R_____) /Users/admin/Library/Safari/LastSession.plist 0.000012 SymDaemon.949 13:03:45.733971 open F=21 (R_____) /Users/admin/Library/Safari/LastSession.plist 0.000012 SymDaemon.949 13:03:45.734131 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A5.tok 0.000039 SymDaemon.949 13:03:45.734162 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A5.tok 0.000024 SymDaemon.949 13:03:45.734750 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000012 SymDaemon.949 13:03:45.735441 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000012 SymDaemon.949 13:03:45.735583 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A6.tok 0.000039 SymDaemon.949 13:03:45.735613 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A6.tok 0.000024 SymDaemon.949 13:03:46.029306 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000024 SymDaemon.950 13:03:46.030559 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:46.031369 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:46.031816 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A7.tok 0.000065 SymDaemon.949 13:03:46.031864 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A7.tok 0.000027 SymDaemon.949 13:03:47.777930 open F=21 (R_____) /Applications/App Store.app 0.000025 SymDaemon.8195 13:03:47.778055 open F=21 (R_____) /Applications/App Store.app/Contents 0.000021 SymDaemon.8195 13:03:47.778160 open F=21 (R_____) /Applications/App Store.app/Contents/Info.plist 0.000026 SymDaemon.8195 13:03:47.778335 open F=21 (R_____) /Applications/App Store.app/Contents/PkgInfo 0.000023 SymDaemon.8195 13:03:48.855144 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000015 SymDaemon.950 13:03:48.856201 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000014 SymDaemon.950 13:03:48.857009 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000012 SymDaemon.950 13:03:48.857642 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.950 13:03:48.858358 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000012 SymDaemon.949 13:03:48.858994 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000012 SymDaemon.949 13:03:48.859262 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A8.tok 0.000076 SymDaemon.949 13:03:48.859300 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A8.tok 0.000029 SymDaemon.949 13:03:48.875228 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000015 SymDaemon.949 13:03:48.876250 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000012 SymDaemon.949 13:03:48.876423 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A9.tok 0.000049 SymDaemon.949 13:03:48.876455 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A9.tok 0.000025 SymDaemon.949 13:03:48.990642 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000017 SymDaemon.949 13:03:48.992131 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000021 SymDaemon.949 13:03:48.992491 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AA.tok 0.000159 SymDaemon.949 13:03:48.992531 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AA.tok 0.000031 SymDaemon.949 13:03:48.993716 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000018 SymDaemon.949 13:03:49.014390 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db 0.000026 SymDaemon.950 13:03:49.018088 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db 0.000013 SymDaemon.950 13:03:49.019323 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000014 SymDaemon.950 13:03:49.020241 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000012 SymDaemon.950 13:03:49.021168 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db 0.000014 SymDaemon.950 13:03:49.022086 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db 0.000013 SymDaemon.950 13:03:49.105892 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.949 13:03:49.106098 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AB.tok 0.000051 SymDaemon.949 13:03:49.106131 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AB.tok 0.000026 SymDaemon.949 13:03:49.107452 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db 0.000151 W SymDaemon.949 13:03:49.108899 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db 0.000014 SymDaemon.949 13:03:49.109316 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AC.tok 0.000048 SymDaemon.949 13:03:49.109349 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AC.tok 0.000025 SymDaemon.949 13:03:49.261103 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db 0.000014 SymDaemon.949 13:03:49.262318 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db 0.000014 SymDaemon.949 13:03:49.262840 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AD.tok 0.000070 SymDaemon.949 13:03:49.262874 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AD.tok 0.000027 SymDaemon.949 13:03:49.318982 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000017 SymDaemon.949 13:03:49.320177 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000013 SymDaemon.949 13:03:49.320595 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AE.tok 0.000054 SymDaemon.949 13:03:49.320627 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AE.tok 0.000025 SymDaemon.949 13:03:49.469812 open F=22 (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions 0.000011 SymDaemon.8196 13:03:49.469954 open F=22 (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions 0.000010 SymDaemon.8196 13:03:49.470041 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Contents>>>>>>>>>>>>>>> 0.000009 SymDaemon.8196 13:03:49.470059 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Support Files>>>>>>>>>> 0.000008 SymDaemon.8196 13:03:49.470074 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/PkgInfo 0.000007 SymDaemon.8196 13:03:49.498642 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000016 SymDaemon.949 13:03:49.499790 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.949 13:03:49.500309 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AF.tok 0.000053 SymDaemon.949 13:03:49.500341 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AF.tok 0.000025 SymDaemon.949 13:03:49.505639 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db 0.000017 SymDaemon.949 13:03:49.507048 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db 0.000017 SymDaemon.949 13:03:49.507494 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B0.tok 0.000066 SymDaemon.949 13:03:49.507528 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B0.tok 0.000027 SymDaemon.949 13:03:49.509300 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db 0.000014 SymDaemon.949 13:03:49.510396 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db 0.000013 SymDaemon.949 13:03:49.510891 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B1.tok 0.000045 SymDaemon.949 13:03:49.510923 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B1.tok 0.000024 SymDaemon.949 13:03:49.530932 open F=21 (R_____) /System/Library/CoreServices/ManagedClient.app 0.000010 SymDaemon.8195 13:03:49.531013 open F=21 (R_____) /System/Library/CoreServices/ManagedClient.app/Contents 0.000011 SymDaemon.8195 13:03:49.531102 open F=21 (R_____) /System/Library/CoreServices/ManagedClient.app/Contents/Info.plist 0.000022 SymDaemon.8195 13:03:49.531224 open F=21 (R_____) /System/Library/CoreServices/ManagedClient.app/Contents/PkgInfo 0.000023 SymDaemon.8195 13:03:50.949531 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000022 SymDaemon.950 13:03:50.952195 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000029 SymDaemon.949 13:03:50.953736 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000022 SymDaemon.949 13:03:50.954603 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B2.tok 0.000074 SymDaemon.949 13:03:50.954640 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B2.tok 0.000028 SymDaemon.949 13:03:51.013404 open F=23 (R_____) /private/var/db/crls/ocspcache.db 0.000027 SymDaemon.950 13:03:51.014626 open F=23 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.950 13:03:51.015468 open F=23 (R_____) /Users/admin/Library/Caches/com.apple.storeagent/updates.plist 0.000014 SymDaemon.950 13:03:51.016121 open F=23 (R_____) /Users/admin/Library/Cookies/com.apple.appstore.cookies 0.000013 SymDaemon.950 13:03:51.016751 open F=23 (R_____) /Library/Application Support/App Store/adoption.plist 0.000013 SymDaemon.950 13:03:51.017400 open F=23 (R_____) /private/var/db/launchd.db/com.apple.launchd/overrides.plist 0.000013 SymDaemon.950 13:03:51.018014 open F=23 (R_____) /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist 0.000025 SymDaemon.950 13:03:51.019227 open F=23 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist 0.000014 SymDaemon.950 13:03:51.047127 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist 0.000017 SymDaemon.950 13:03:51.048112 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist 0.000013 SymDaemon.950 13:03:51.048859 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.nsservicescache.plist 0.000013 SymDaemon.950 13:03:51.050043 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000013 SymDaemon.949 13:03:51.050852 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:51.051252 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B3.tok 0.000054 SymDaemon.949 13:03:51.051284 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B3.tok 0.000025 SymDaemon.949 13:03:51.074181 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.949 13:03:51.075109 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000012 SymDaemon.949 13:03:51.075291 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B4.tok 0.000045 SymDaemon.949 13:03:51.075323 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B4.tok 0.000025 SymDaemon.949 13:03:51.094970 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.storeagent/updates.plist 0.000016 SymDaemon.949 13:03:51.095786 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.storeagent/updates.plist 0.000013 SymDaemon.949 13:03:51.095970 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B5.tok 0.000052 SymDaemon.949 13:03:51.096002 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B5.tok 0.000025 SymDaemon.949 13:03:51.127147 open F=21 (R_____) /Users/admin/Library/Cookies/com.apple.appstore.cookies 0.000016 SymDaemon.949 13:03:51.127955 open F=21 (R_____) /Users/admin/Library/Cookies/com.apple.appstore.cookies 0.000012 SymDaemon.949 13:03:51.128160 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B6.tok 0.000053 SymDaemon.949 13:03:51.128192 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B6.tok 0.000025 SymDaemon.949 13:03:51.145362 open F=21 (R_____) /Library/Application Support/App Store/adoption.plist 0.000014 SymDaemon.949 13:03:51.146177 open F=21 (R_____) /Library/Application Support/App Store/adoption.plist 0.000012 SymDaemon.949 13:03:51.146259 open F=22 (R_____) /Library/Application Support/App Store/adoption.plist 0.000012 SymDaemon.949 13:03:51.146436 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B7.tok 0.000050 SymDaemon.949 13:03:51.146467 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B7.tok 0.000025 SymDaemon.949 13:03:51.164358 open F=21 (R_____) /private/var/db/launchd.db/com.apple.launchd/overrides.plist 0.000016 SymDaemon.949 13:03:51.165194 open F=21 (R_____) /private/var/db/launchd.db/com.apple.launchd/overrides.plist 0.000012 SymDaemon.949 13:03:51.165264 open F=22 (R_____) /private/var/db/launchd.db/com.apple.launchd/overrides.plist 0.000012 SymDaemon.949 13:03:51.165435 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B8.tok 0.000052 SymDaemon.949 13:03:51.165466 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B8.tok 0.000025 SymDaemon.949 13:03:51.179368 open F=21 (R_____) /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist 0.000026 SymDaemon.949 13:03:51.180143 open F=21 (R_____) /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist 0.000021 SymDaemon.949 13:03:51.180216 open F=22 (R_____) /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist 0.000020 SymDaemon.949 13:03:51.180391 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B9.tok 0.000047 SymDaemon.949 13:03:51.180421 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B9.tok 0.000024 SymDaemon.949 13:03:51.241986 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist 0.000014 SymDaemon.949 13:03:51.243114 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist 0.000012 SymDaemon.949 13:03:51.243706 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BA.tok 0.000058 SymDaemon.949 13:03:51.243739 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BA.tok 0.000026 SymDaemon.949 13:03:51.463647 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist 0.000016 SymDaemon.949 13:03:51.464705 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist 0.000013 SymDaemon.949 13:03:51.464935 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BB.tok 0.000053 SymDaemon.949 13:03:51.465020 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BB.tok 0.000079 SymDaemon.949 13:03:51.468332 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist 0.000014 SymDaemon.949 13:03:51.469153 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist 0.000013 SymDaemon.949 13:03:51.469393 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BC.tok 0.000044 SymDaemon.949 13:03:51.469423 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BC.tok 0.000024 SymDaemon.949 13:03:51.474846 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.nsservicescache.plist 0.000013 SymDaemon.949 13:03:51.477227 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.nsservicescache.plist 0.000018 SymDaemon.949 13:03:51.477536 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BD.tok 0.000071 SymDaemon.949 13:03:51.477573 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BD.tok 0.000029 SymDaemon.949 13:03:53.387589 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library.itl 0.000025 SymDaemon.950 13:03:53.391003 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Extras.itdb 0.000014 SymDaemon.950 13:03:53.392889 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000013 SymDaemon.950 13:03:53.393453 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library.itl 0.000012 SymDaemon.949 13:03:53.397652 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library.itl 0.000013 SymDaemon.949 13:03:53.398128 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BE.tok 0.000063 SymDaemon.949 13:03:53.398163 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BE.tok 0.000027 SymDaemon.949 13:03:53.399048 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Extras.itdb 0.000012 SymDaemon.949 13:03:53.400789 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Extras.itdb 0.000012 SymDaemon.949 13:03:53.401775 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BF.tok 0.000041 SymDaemon.949 13:03:53.401806 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BF.tok 0.000025 SymDaemon.949 13:03:53.403029 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000012 SymDaemon.949 13:03:53.403542 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000012 SymDaemon.949 13:03:53.403666 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C0.tok 0.000038 SymDaemon.949 13:03:53.403696 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C0.tok 0.000024 SymDaemon.949 13:04:00.547142 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000024 SymDaemon.950 13:04:00.548411 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:04:00.549268 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000012 SymDaemon.949 13:04:00.549465 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C1.tok 0.000060 SymDaemon.949 13:04:00.549499 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C1.tok 0.000026 SymDaemon.949 13:04:03.157699 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000025 SymDaemon.950 13:04:03.158584 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000013 SymDaemon.950 13:04:03.159448 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.950 13:04:03.160108 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000013 SymDaemon.950 13:04:03.161050 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.appstore.plist 0.000013 SymDaemon.950 13:04:03.161717 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.storeagent.plist 0.000013 SymDaemon.950 13:04:03.162340 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000012 SymDaemon.949 13:04:03.162976 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000012 SymDaemon.949 13:04:03.163193 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C2.tok 0.000066 SymDaemon.949 13:04:03.163227 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C2.tok 0.000026 SymDaemon.949 13:04:03.163702 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000012 SymDaemon.949 13:04:03.164429 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000012 SymDaemon.949 13:04:03.164572 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C3.tok 0.000039 SymDaemon.949 13:04:03.164603 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C3.tok 0.000024 SymDaemon.949 13:04:03.173689 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.949 13:04:03.175251 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.949 13:04:03.175413 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C4.tok 0.000043 SymDaemon.949 13:04:03.175444 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C4.tok 0.000024 SymDaemon.949 13:04:03.175838 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000012 SymDaemon.949 13:04:03.176725 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000012 SymDaemon.949 13:04:03.176865 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C5.tok 0.000039 SymDaemon.949 13:04:03.176907 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C5.tok 0.000036 SymDaemon.949 13:04:03.177854 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.appstore.plist 0.000012 SymDaemon.949 13:04:03.178457 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.appstore.plist 0.000012 SymDaemon.949 13:04:03.178620 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C6.tok 0.000039 SymDaemon.949 13:04:03.178651 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C6.tok 0.000024 SymDaemon.949 13:04:03.179437 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.storeagent.plist 0.000012 SymDaemon.949 13:04:03.180003 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.storeagent.plist 0.000012 SymDaemon.949 13:04:03.180137 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C7.tok 0.000038 SymDaemon.949 13:04:03.180167 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C7.tok 0.000024 SymDaemon.949 13:04:10.997639 open F=21 (R_____) /Users/admin/Desktop/OFF.log 0.000024 SymDaemon.950 13:04:10.998761 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db-wal 0.000014 SymDaemon.950 13:04:10.999343 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db 0.000013 SymDaemon.950 13:04:11.001468 open F=21 (R_____) /Users/admin/Desktop/OFF.log 0.000012 SymDaemon.949 13:04:11.002370 open F=21 (R_____) /Users/admin/Desktop/OFF.log 0.000012 SymDaemon.949 13:04:11.002449 open F=22 (R_____) /Users/admin/Desktop/OFF.log 0.000012 SymDaemon.949 13:04:11.002655 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C8.tok 0.000068 SymDaemon.949 13:04:11.002688 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C8.tok 0.000026 SymDaemon.949 13:04:11.045240 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db-wal 0.000014 SymDaemon.949 13:04:11.045786 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db-wal 0.000012 SymDaemon.949 13:04:11.045946 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db 0.000012 SymDaemon.949 13:04:11.049096 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db 0.000012 SymDaemon.949 13:04:11.050999 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C9.tok 0.000051 SymDaemon.949 13:04:11.051031 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C9.tok
Below is an example from an idle Macintosh, filtered on open operations, where Auto-Protect scanning of compressed files is disabled:
12:59:12.200034 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000026 SymDaemon.950 12:59:13.788970 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data 0.000025 SymDaemon.950 12:59:13.791806 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist 0.000014 SymDaemon.950 12:59:14.866217 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000028 SymDaemon.950 12:59:20.881158 open F=20 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000025 SymDaemon.950 12:59:28.180117 open F=20 (R_____) /private/var/db/systemstats/snapshots.db-wal 0.000026 SymDaemon.950 12:59:28.180971 open F=20 (R_____) /private/var/db/systemstats/snapshots.db 0.000013 SymDaemon.950 12:59:45.493017 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000025 SymDaemon.950 12:59:45.494278 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.950 13:00:02.824416 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000028 SymDaemon.950 13:00:12.177829 open F=20 (R_____) /Applications/Safari.app 0.000030 SymDaemon.7119 13:00:12.180053 open F=20 (R_____) /Applications/Safari.app/Contents 0.000026 SymDaemon.7119 13:00:12.180168 open F=20 (R_____) /Applications/Safari.app/Contents/Info.plist 0.000028 SymDaemon.7119 13:00:12.180667 open F=20 (R_____) /Applications/Safari.app/Contents/PkgInfo 0.000024 SymDaemon.7119 13:00:12.626987 open F=20 (R_____) /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app 0.000013 SymDaemon.7119 13:00:12.627083 open F=20 (R_____) /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents 0.000012 SymDaemon.7119 13:00:12.627177 open F=20 (R_____) /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/Info.plist 0.000027 SymDaemon.7119 13:00:12.627332 open F=20 (R_____) /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/PkgInfo 0.000023 SymDaemon.7119 13:00:13.085954 open F=20 (R_____) A/Frameworks/LaunchServices.framework 0.000018 SymDaemon.7119 13:00:13.086077 open F=20 (R_____) A/Resources 0.000018 SymDaemon.7119 13:00:13.086376 open F=20 (R_____) A/Resources/Info.plist 0.000052 SymDaemon.7119 13:00:13.089136 open [ 2] (R_____) A/Frameworks/LaunchServices.framework/Contents>>>>>>>>>> 0.000013 SymDaemon.7119 13:00:13.089158 open [ 2] (R_____) A/Frameworks/LaunchServices.framework/Support Files>>>>> 0.000011 SymDaemon.7119 13:00:13.089177 open [ 2] (R_____) A/Frameworks/LaunchServices.framework/PkgInfo 0.000010 SymDaemon.7119 13:00:13.089346 open F=20 (R_____) /System 0.000020 SymDaemon.7119 13:00:13.089476 open F=20 (R_____) /System 0.000009 SymDaemon.7119 13:00:13.089543 open [ 2] (R_____) /System/Contents>>>>>>>> 0.000007 SymDaemon.7119 13:00:13.089558 open [ 2] (R_____) /System/Support Files>>> 0.000007 SymDaemon.7119 13:00:13.089571 open [ 2] (R_____) /System/PkgInfo 0.000006 SymDaemon.7119 13:00:13.273182 open F=20 (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework 0.000011 SymDaemon.7119 13:00:13.289982 open F=20 (R_____) A/Resources 0.000017 SymDaemon.7119 13:00:13.290069 open F=20 (R_____) A/Resources/Info.plist 0.000027 SymDaemon.7119 13:00:13.290508 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/Contents>>>>>>>>>>>>>>>>>>>>> 0.000009 SymDaemon.7119 13:00:13.290525 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support Files>>>>>>>>>>>>>>>> 0.000008 SymDaemon.7119 13:00:13.290540 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/PkgInfo 0.000007 SymDaemon.7119 13:00:14.012005 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000022 SymDaemon.950 13:00:14.013483 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.PubSubAgent.plist 0.000013 SymDaemon.950 13:00:14.014209 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000013 SymDaemon.950 13:00:15.048007 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore 0.000016 SymDaemon.950 13:00:15.049234 open F=20 (R_____) /Users/admin/Library/SyncedPreferences/com.apple.syncedpreferences.plist 0.000014 SymDaemon.950 13:00:15.050043 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.Safari/com.apple.sandbox/sandbox-cache.db 0.000014 SymDaemon.950 13:00:15.051103 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.IconServices/6100D2A3FF19F8B18C1B86F91DBC3BC5.iscachebmp 0.000013 SymDaemon.950 13:00:16.050942 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.Networking+com.apple.Safari/com.apple.sandbox/sandbox-cache.db 0.000022 SymDaemon.950 13:00:17.140451 open F=20 (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions 0.000015 SymDaemon.7119 13:00:17.157535 open F=20 (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions 0.000013 SymDaemon.7119 13:00:17.160556 open [ 2] (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions/Contents>>>>>>>>>>>>>>>>>>>>>>>> 0.000011 SymDaemon.7119 13:00:17.160573 open [ 2] (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions/Support Files>>>>>>>>>>>>>>>>>>> 0.000007 SymDaemon.7119 13:00:17.160597 open [ 2] (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions/PkgInfo 0.000016 SymDaemon.7119 13:00:17.218248 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000031 SymDaemon.950 13:00:17.219648 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.950 13:00:17.220892 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000013 SymDaemon.950 13:00:19.005893 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000024 SymDaemon.950 13:00:19.011780 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000016 SymDaemon.950 13:00:19.012747 open F=20 (R_____) /Users/admin/Library/Preferences/.GlobalPreferences.plist 0.000013 SymDaemon.950 13:00:19.013460 open F=20 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.950 13:00:19.014525 open F=20 (R_____) /Users/admin/Library/Safari/Configurations.plist.signed 0.000013 SymDaemon.950 13:00:19.015608 open F=20 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000029 SymDaemon.950 13:00:19.077770 open F=20 (R_____) /Users/admin/Library/PubSub/Clients.plist 0.000013 SymDaemon.950 13:00:19.802168 open F=20 (R_____) /Applications/Safari.app 0.000024 SymDaemon.7149 13:00:19.802274 open F=20 (R_____) /Applications/Safari.app/Contents 0.000020 SymDaemon.7149 13:00:19.802384 open F=20 (R_____) /Applications/Safari.app/Contents/Info.plist 0.000028 SymDaemon.7149 13:00:19.802887 open F=20 (R_____) /Applications/Safari.app/Contents/PkgInfo 0.000023 SymDaemon.7149 13:00:21.769278 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.help.plist 0.000029 SymDaemon.950 13:00:21.770498 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000013 SymDaemon.950 13:00:21.771249 open F=20 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist 0.000014 SymDaemon.950 13:00:21.773267 open F=20 (R_____) /Users/admin/Library/Preferences/QuickTime Preferences 0.000014 SymDaemon.950 13:00:21.774499 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.quicktime.plugin.preferences.plist 0.000014 SymDaemon.950 13:00:21.775551 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/77C0C2D0-E042-437A-9100-D27CA7FD2425.webbookmark 0.000013 SymDaemon.950 13:00:21.777461 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/C6031387-61B7-49B1-8A9A-D7C6C87DE78D.webbookmark 0.000015 SymDaemon.950 13:00:21.778163 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/83EEF489-E547-42F6-863B-354E93A680A2.webbookmark 0.000013 SymDaemon.950 13:00:21.778786 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/47035D3E-FDF5-48F1-B517-F0A00E521C07.webbookmark 0.000014 SymDaemon.950 13:00:22.181192 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/B4B283AB-C684-47CA-9B1F-8C4F06B21572.webbookmark 0.000017 SymDaemon.950 13:00:22.182105 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/6B057C96-609F-4B63-8E37-14FA085A1C4C.webbookmark 0.000014 SymDaemon.950 13:00:22.182768 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/3FCC16BB-E56A-4DB5-8941-33170A67B99F.webbookmark 0.000014 SymDaemon.950 13:00:22.183478 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/402ADB1C-C3C0-4CD1-8158-B45C4D8E438C.webbookmark 0.000013 SymDaemon.950 13:00:22.184158 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/CCDEA395-8D07-4670-8308-1471D7793EB1.webbookmark 0.000013 SymDaemon.950 13:00:22.184815 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/E5DDF305-0348-4C54-8D36-B165C79984D8.webbookmark 0.000013 SymDaemon.950 13:00:22.186045 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/3CDDF82B-8590-4963-9D41-066DB0574505.webbookmark 0.000014 SymDaemon.950 13:00:22.186705 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/62A98F7F-5C73-497C-AC5A-B48FE618D404.webbookmark 0.000013 SymDaemon.950 13:00:22.187574 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/DA234375-1282-4BC8-81D8-25EA4B638E69.webbookmark 0.000013 SymDaemon.950 13:00:22.188271 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/9B6374E2-DA43-4F4C-BDA0-BF382E17521F.webbookmark 0.000013 SymDaemon.950 13:00:22.188939 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/6D51CBD4-03FA-4370-AD96-CF956F2D17BF.webbookmark 0.000013 SymDaemon.950 13:00:22.189558 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/C3248BD4-C35F-48F4-B58F-A6D6EE78BE1E.webbookmark 0.000013 SymDaemon.950 13:00:22.190367 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/78C8B380-4513-455B-B6DF-AD0B83043243.webbookmark 0.000013 SymDaemon.950 13:00:22.191011 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/2817963C-D664-42D1-89C5-B8C8912CADCB.webbookmark 0.000013 SymDaemon.950 13:00:22.191652 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/96441F34-A8FD-46D9-A524-7050100186A0.webbookmark 0.000013 SymDaemon.950 13:00:22.201184 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/93915673-0C21-4AC6-A67B-7F9D4B9A5559.webbookmark 0.000015 SymDaemon.950 13:00:22.201955 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data 0.000013 SymDaemon.950 13:00:22.202907 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist 0.000013 SymDaemon.950 13:00:22.361589 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000018 SymDaemon.950 13:00:23.187710 open F=20 (R_____) /System 0.000026 SymDaemon.7119 13:00:23.187866 open F=20 (R_____) /System 0.000009 SymDaemon.7119 13:00:23.187953 open [ 2] (R_____) /System/Contents>>>>>>>> 0.000008 SymDaemon.7119 13:00:23.187971 open [ 2] (R_____) /System/Support Files>>> 0.000007 SymDaemon.7119 13:00:23.187985 open [ 2] (R_____) /System/PkgInfo 0.000007 SymDaemon.7119 13:00:25.062208 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/75B9C4C4-FA40-4489-ABEA-FFB4221D1F8E 0.000027 SymDaemon.950 13:00:25.063510 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore 0.000014 SymDaemon.950 13:00:25.064300 open F=20 (R_____) /Users/admin/Library/Safari/TopSites.plist 0.000013 SymDaemon.950 13:00:25.065020 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/index.sqlite 0.000014 SymDaemon.950 13:00:27.514080 open F=20 (R_____) /Users/admin/Library/Safari/WebpageIcons.db 0.000028 SymDaemon.950 13:00:27.516109 open F=20 (R_____) /Users/admin/Library/Safari/LastSession.plist 0.000014 SymDaemon.950 13:00:27.516849 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/580F555A-AD45-424B-9320-D743D877F596 0.000014 SymDaemon.950 13:00:27.517500 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/0A9C8198-8A19-43AD-A8FD-C598DCC46470 0.000013 SymDaemon.950 13:00:27.518067 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/FDBB7D0E-E4BC-4A29-97D7-9614754CE29C 0.000014 SymDaemon.950 13:00:27.518634 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/A66DFC9E-8067-49CA-889B-6C16C500DCD7 0.000013 SymDaemon.950 13:00:27.519947 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/21417647-DC56-4651-ADD2-C7024403FDCF 0.000014 SymDaemon.950 13:00:27.521247 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/2DE01F36-F367-4FBA-9804-A3AFC0B69A77 0.000013 SymDaemon.950 13:00:28.072682 open F=20 (R_____) /Applications/iTunes.app 0.000034 SymDaemon.7119 13:00:28.072798 open F=20 (R_____) /Applications/iTunes.app/Contents 0.000021 SymDaemon.7119 13:00:28.072908 open F=20 (R_____) /Applications/iTunes.app/Contents/Info.plist 0.000028 SymDaemon.7119 13:00:28.073588 open F=20 (R_____) /Applications/iTunes.app/Contents/PkgInfo 0.000024 SymDaemon.7119 13:00:28.074136 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/569AB7AC-CB4B-40A5-8F6F-C25F35360D23 0.000014 SymDaemon.950 13:00:28.075656 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/4A448E90-0FAD-40F9-9D9E-05C69D2522EE 0.000014 SymDaemon.950 13:00:28.076330 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/436642F8-8345-4886-9183-EE2986D0E2EA 0.000013 SymDaemon.950 13:00:28.077520 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/09EB8C21-D2E6-4B1A-9A33-03999679763B 0.000013 SymDaemon.950 13:00:28.078199 open F=20 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist 0.000013 SymDaemon.950 13:00:28.079107 open F=20 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist 0.000013 SymDaemon.950 13:00:28.079958 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.nsservicescache.plist 0.000013 SymDaemon.950 13:00:28.080919 open F=20 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.950 13:00:30.134883 open F=20 (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions 0.000016 SymDaemon.7119 13:00:30.135032 open F=20 (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions 0.000010 SymDaemon.7119 13:00:30.135106 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Contents>>>>>>>>>>>>>>> 0.000009 SymDaemon.7119 13:00:30.135124 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Support Files>>>>>>>>>> 0.000007 SymDaemon.7119 13:00:30.135139 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/PkgInfo 0.000008 SymDaemon.7119 13:00:30.135477 open F=20 (R_____) /Users/admin/Library/Caches/QCCompositionRepository-com.apple.iTunes.cache 0.000014 SymDaemon.950 13:00:30.136715 open F=20 (R_____) /Users/admin/Music/iTunes/sentinel 0.000013 SymDaemon.950 13:00:30.138054 open F=20 (R_____) /Users/admin/Music/iTunes/iTunes Library Genius.itdb 0.000012 SymDaemon.950 13:00:30.168215 open F=20 (R_____) private/var/log/system.log 0.000022 SymDaemon.7149 13:00:31.008865 open F=21 (R_____) /Users/admin/Library/Containers/com.apple.BKAgentService/Container.plist 0.000015 SymDaemon.950 13:00:31.010139 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.950 13:00:32.789758 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.sandbox/sandbox-cache.db 0.000019 SymDaemon.950 13:00:32.805909 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/.iTunes Preferences.plist 0.000016 SymDaemon.950 13:00:32.808049 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ar.strings 0.000031 SymDaemon.950 13:00:32.808772 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ca.strings 0.000028 SymDaemon.950 13:00:32.809719 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/cs.strings 0.000029 SymDaemon.950 13:00:32.810409 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/da.strings 0.000028 SymDaemon.950 13:00:32.811159 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Dutch.strings 0.000029 SymDaemon.950 13:00:32.811843 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/el.strings 0.000042 SymDaemon.950 13:00:32.812505 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/en_GB.strings 0.000028 SymDaemon.950 13:00:32.813186 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/English.strings 0.000028 SymDaemon.950 13:00:32.813833 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/fi.strings 0.000039 SymDaemon.950 13:00:32.814507 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/French.strings 0.000028 SymDaemon.950 13:00:32.815374 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/German.strings 0.000028 SymDaemon.950 13:00:32.816054 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/he.strings 0.000029 SymDaemon.950 13:00:32.816753 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/hr.strings 0.000028 SymDaemon.950 13:00:32.817638 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/hu.strings 0.000028 SymDaemon.950 13:00:32.818330 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/id.strings 0.000029 SymDaemon.950 13:00:32.820483 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Italian.strings 0.000031 SymDaemon.950 13:00:32.821200 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Japanese.strings 0.000029 SymDaemon.950 13:00:32.821889 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ko.strings 0.000028 SymDaemon.950 13:00:32.822581 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ms.strings 0.000027 SymDaemon.950 13:00:32.823278 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/no.strings 0.000029 SymDaemon.950 13:00:32.823948 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pl.strings 0.000028 SymDaemon.950 13:00:32.824654 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pt.strings 0.000027 SymDaemon.950 13:00:32.825612 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pt_PT.strings 0.000031 SymDaemon.950 13:00:32.826292 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ro.strings 0.000028 SymDaemon.950 13:00:32.826983 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ru.strings 0.000028 SymDaemon.950 13:00:32.827654 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/sk.strings 0.000027 SymDaemon.950 13:00:32.828318 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Spanish.strings 0.000029 SymDaemon.950 13:00:32.828999 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/sv.strings 0.000028 SymDaemon.950 13:00:32.829660 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/th.strings 0.000028 SymDaemon.950 13:00:32.830343 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/tr.strings 0.000028 SymDaemon.950 13:00:32.831095 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/uk.strings 0.000028 SymDaemon.950 13:00:32.831760 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/vi.strings 0.000028 SymDaemon.950 13:00:32.832441 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/zh_CN.strings 0.000028 SymDaemon.950 13:00:32.833108 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/zh_TW.strings 0.000028 SymDaemon.950 13:00:32.833797 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000014 SymDaemon.950 13:00:32.834776 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000012 SymDaemon.950 13:00:33.171149 open F=21 (R_____) /System 0.000026 SymDaemon.7149 13:00:33.171310 open F=21 (R_____) /System 0.000009 SymDaemon.7149 13:00:33.171384 open [ 2] (R_____) /System/Contents>>>>>>>> 0.000007 SymDaemon.7149 13:00:33.171401 open [ 2] (R_____) /System/Support Files>>> 0.000007 SymDaemon.7149 13:00:33.171415 open [ 2] (R_____) /System/PkgInfo 0.000007 SymDaemon.7149 13:00:33.173378 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000016 SymDaemon.950 13:00:33.174561 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000013 SymDaemon.950 13:00:33.175599 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000013 SymDaemon.950 13:00:33.176470 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000013 SymDaemon.950 13:00:33.177131 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000014 SymDaemon.950 13:00:33.178044 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist 0.000019 SymDaemon.950 13:00:33.179497 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000018 SymDaemon.950 13:00:33.180746 open F=21 (R_____) /Users/admin/Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/Books.plist 0.000014 SymDaemon.950 13:00:33.182208 open F=21 (R_____) /Users/admin/Library/Cookies/com.apple.ibooks.cookies 0.000013 SymDaemon.950 13:00:33.182840 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.bookstoreagent.plist 0.000013 SymDaemon.950 13:00:35.179280 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore 0.000017 SymDaemon.950 13:00:35.180362 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library.itl 0.000013 SymDaemon.950 13:00:35.185564 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.loginitems.plist 0.000015 SymDaemon.950 13:00:35.186232 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Music Library.xml 0.000013 SymDaemon.950 13:00:35.948335 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000014 SymDaemon.7119 13:00:35.948503 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000012 SymDaemon.7119 13:00:35.948581 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Contents>>>>>>> 0.000012 SymDaemon.7119 13:00:35.948601 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Support Files>> 0.000010 SymDaemon.7119 13:00:35.948625 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/PkgInfo 0.000016 SymDaemon.7119 13:00:36.265471 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iApps.plist 0.000027 SymDaemon.950 13:00:36.266371 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Extras.itdb 0.000013 SymDaemon.950 13:00:36.267276 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Genius.itdb 0.000013 SymDaemon.950 13:00:36.268298 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000013 SymDaemon.950 13:00:36.268894 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.eq.plist 0.000024 SymDaemon.950 13:00:36.269742 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.950 13:00:44.647426 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000027 SymDaemon.950 13:00:48.130293 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000026 SymDaemon.950 13:00:48.131366 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist 0.000013 SymDaemon.950 13:00:48.132192 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.bookstoreagent.plist 0.000013 SymDaemon.950 13:00:48.132858 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.950 13:00:48.133479 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000012 SymDaemon.950 13:00:49.012579 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000014 SymDaemon.7119 13:00:49.012727 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000012 SymDaemon.7119 13:00:49.012804 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Contents>>>>>>> 0.000011 SymDaemon.7119 13:00:49.012836 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Support Files>> 0.000022 SymDaemon.7119 13:00:49.012854 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/PkgInfo 0.000010 SymDaemon.7119 13:00:49.016564 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000013 SymDaemon.7119 13:00:49.016698 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000012 SymDaemon.7119 13:00:49.016772 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Contents>>>>>>> 0.000011 SymDaemon.7119 13:00:49.016792 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Support Files>> 0.000010 SymDaemon.7119 13:00:49.016810 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/PkgInfo 0.000010 SymDaemon.7119 13:00:58.131598 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000025 SymDaemon.950
Feedback
Yes
No
Powered by
