How to use Macintosh fs_usage command line to trace SEP file activity

book

Article ID: 178269

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

 

Resolution

From Macintosh Terminal application's command line:

sudo -b fs_usage -w -f pathname SymDaemon > ~/Desktop/symdaemon.log

This will run fs_usage in the background, logging all SymDaemon operations involving file pathnames. Double-click symdaemon.log on the Desktop and you can view its contents in realtime using the Macintosh Console application. It may be helpful to choose "Wrap Lines at Line Breaks" from View menu and close / re-open the log. The Macintosh Console app can also filter your view of any log to include only those lines that match strings in the "Filter" text area at upper-right of window. You can also save filtered views into a new log file. For example, if you want a record only of all open operations for eicar test files, type "open eicar" into Filter.

While fs_usage is running, you can empty and restart the log file by typing the following into the Terminal command line:

> ~/Desktop/symdaemon.log

When you are ready to stop logging, type:

sudo killall fs_usage

Below is an example log file from an idle Macintosh, filtered to show open operations only. Auto-Protect scanning of compressed files is enabled.

13:02:34.268072  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008E.tok                                                                                                                 0.000070   SymDaemon.949
13:02:34.268108  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008E.tok                                                                                                                 0.000028   SymDaemon.949
13:02:39.034659  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000016   SymDaemon.950
13:02:39.035545  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:39.036117  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:39.036208  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:39.036437  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008F.tok                                                                                                                 0.000051   SymDaemon.949
13:02:39.036469  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008F.tok                                                                                                                 0.000026   SymDaemon.949
13:02:41.235027  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000026   SymDaemon.950
13:02:41.235919  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:41.236492  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:41.236562  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:41.236763  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000090.tok                                                                                                                 0.000062   SymDaemon.949
13:02:41.236795  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000090.tok                                                                                                                 0.000026   SymDaemon.949
13:02:51.280318  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data                                                                                  0.000025   SymDaemon.950
13:02:51.283946  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist                                                                              0.000014   SymDaemon.950
13:02:51.286407  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data                                                                                  0.000013   SymDaemon.949
13:02:51.289351  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data                                                                                  0.000013   SymDaemon.949
13:02:51.289862  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000091.tok                                                                                                                 0.000062   SymDaemon.949
13:02:51.289908  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000091.tok                                                                                                                 0.000038   SymDaemon.949
13:02:51.305457  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist                                                                              0.000015   SymDaemon.949
13:02:51.308111  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist                                                                              0.000013   SymDaemon.949
13:02:51.308374  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000092.tok                                                                                                                 0.000053   SymDaemon.949
13:02:51.308406  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000092.tok                                                                                                                 0.000025   SymDaemon.949
13:03:05.473887  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000024   SymDaemon.950
13:03:05.475173  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.950
13:03:05.477793  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:03:05.478664  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:03:05.478874  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000093.tok                                                                                                                 0.000073   SymDaemon.949
13:03:05.478908  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000093.tok                                                                                                                 0.000026   SymDaemon.949
13:03:05.481241  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000012   SymDaemon.949
13:03:05.483928  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.949
13:03:05.484168  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000094.tok                                                                                                                 0.000046   SymDaemon.949
13:03:05.484199  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000094.tok                                                                                                                 0.000024   SymDaemon.949
13:03:06.547550  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000024   SymDaemon.950
13:03:06.548448  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000013   SymDaemon.949
13:03:06.549029  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000012   SymDaemon.949
13:03:06.549236  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000095.tok                                                                                                                 0.000061   SymDaemon.949
13:03:06.549270  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000095.tok                                                                                                                 0.000026   SymDaemon.949
13:03:12.057672  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist                                                                                             0.000025   SymDaemon.950
13:03:12.058693  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist                                                                                             0.000013   SymDaemon.949
13:03:12.059341  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist                                                                                             0.000012   SymDaemon.949
13:03:12.059637  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000096.tok                                                                                                                 0.000063   SymDaemon.949
13:03:12.059671  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000096.tok                                                                                                                 0.000026   SymDaemon.949
13:03:30.193070  open              F=21       (R_____)  /private/var/db/locationd/clients.plist                                                                                                                               0.000030   SymDaemon.950
13:03:30.194220  open              F=21       (R_____)  /private/var/db/locationd/clients.plist                                                                                                                               0.000013   SymDaemon.949
13:03:30.194805  open              F=21       (R_____)  /private/var/db/locationd/clients.plist                                                                                                                               0.000012   SymDaemon.949
13:03:30.195009  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000097.tok                                                                                                                 0.000068   SymDaemon.949
13:03:30.195043  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000097.tok                                                                                                                 0.000027   SymDaemon.949
13:03:32.795182  open              F=21       (R_____)  /Applications/Safari.app                                                                                                                                              0.000023   SymDaemon.8195
13:03:32.795282  open              F=21       (R_____)  /Applications/Safari.app/Contents                                                                                                                                     0.000020   SymDaemon.8195
13:03:32.795390  open              F=21       (R_____)  /Applications/Safari.app/Contents/Info.plist                                                                                                                          0.000026   SymDaemon.8195
13:03:32.795903  open              F=21       (R_____)  /Applications/Safari.app/Contents/PkgInfo                                                                                                                             0.000039   SymDaemon.8195
13:03:33.937837  open              F=21       (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework                                                                                                            0.000010   SymDaemon.8195
13:03:33.937960  open              F=21       (R_____)  A/Resources                                                                                                                                                           0.000016   SymDaemon.8195
13:03:33.938056  open              F=21       (R_____)  A/Resources/Info.plist                                                                                                                                                0.000027   SymDaemon.8195
13:03:33.938489  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/Contents>>>>>>>>>>>>>>>>>>>>>                                                                              0.000015   SymDaemon.8195
13:03:33.938511  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support Files>>>>>>>>>>>>>>>>                                                                              0.000012   SymDaemon.8195
13:03:33.938531  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/PkgInfo                                                                                                    0.000012   SymDaemon.8195
13:03:35.746456  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000026   SymDaemon.950
13:03:35.748028  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000014   SymDaemon.950
13:03:35.750901  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000025   SymDaemon.950
13:03:35.751844  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.950
13:03:35.752813  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:03:35.753820  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:03:35.754242  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000098.tok                                                                                                                 0.000065   SymDaemon.949
13:03:35.754277  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000098.tok                                                                                                                 0.000026   SymDaemon.949
13:03:35.757266  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.949
13:03:35.760008  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.949
13:03:35.760275  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000099.tok                                                                                                                 0.000050   SymDaemon.949
13:03:35.760307  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000099.tok                                                                                                                 0.000025   SymDaemon.949
13:03:35.760954  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000013   SymDaemon.949
13:03:35.761856  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000012   SymDaemon.949
13:03:35.762240  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009A.tok                                                                                                                 0.000040   SymDaemon.949
13:03:35.762270  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009A.tok                                                                                                                 0.000024   SymDaemon.949
13:03:35.766091  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.949
13:03:35.767116  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000012   SymDaemon.949
13:03:35.767614  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009B.tok                                                                                                                 0.000056   SymDaemon.949
13:03:35.767645  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009B.tok                                                                                                                 0.000024   SymDaemon.949
13:03:36.772356  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000020   SymDaemon.950
13:03:36.773550  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000013   SymDaemon.949
13:03:36.774185  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000014   SymDaemon.949
13:03:36.774466  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009C.tok                                                                                                                 0.000073   SymDaemon.949
13:03:36.774504  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009C.tok                                                                                                                 0.000029   SymDaemon.949
13:03:40.309272  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data                                                                                    0.000025   SymDaemon.950
13:03:40.311591  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist                                                                                0.000014   SymDaemon.950
13:03:40.332034  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data                                                                                    0.000018   SymDaemon.949
13:03:40.332930  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data                                                                                    0.000013   SymDaemon.949
13:03:40.333223  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009D.tok                                                                                                                 0.000062   SymDaemon.949
13:03:40.333256  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009D.tok                                                                                                                 0.000026   SymDaemon.949
13:03:40.334365  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist                                                                                0.000013   SymDaemon.949
13:03:40.341578  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist                                                                                0.000016   SymDaemon.949
13:03:40.341878  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009E.tok                                                                                                                 0.000057   SymDaemon.949
13:03:40.341925  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009E.tok                                                                                                                 0.000026   SymDaemon.949
13:03:40.841251  open              F=21       (R_____)  /Applications/iTunes.app                                                                                                                                              0.000022   SymDaemon.8195
13:03:40.841364  open              F=21       (R_____)  /Applications/iTunes.app/Contents                                                                                                                                     0.000020   SymDaemon.8195
13:03:40.841468  open              F=21       (R_____)  /Applications/iTunes.app/Contents/Info.plist                                                                                                                          0.000026   SymDaemon.8195
13:03:40.842240  open              F=21       (R_____)  /Applications/iTunes.app/Contents/PkgInfo                                                                                                                             0.000024   SymDaemon.8195
13:03:42.216811  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000015   SymDaemon.950
13:03:42.222765  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000013   SymDaemon.949
13:03:42.229259  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000014   SymDaemon.949
13:03:44.389992  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000212 W SymDaemon.950
13:03:44.392944  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000014   SymDaemon.950
13:03:44.395188  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data                                                                                    0.000015   SymDaemon.950
13:03:44.395885  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist                                                                                0.000013   SymDaemon.950
13:03:44.396224  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000013   SymDaemon.949
13:03:44.397107  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000013   SymDaemon.949
13:03:44.397527  open              F=23       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009F.tok                                                                                                                 0.000061   SymDaemon.949
13:03:44.397561  open              F=23       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009F.tok                                                                                                                 0.000027   SymDaemon.949
13:03:44.427401  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000015   SymDaemon.949
13:03:44.428513  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.949
13:03:44.429012  open              F=23       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A0.tok                                                                                                                 0.000052   SymDaemon.949
13:03:44.429044  open              F=23       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A0.tok                                                                                                                 0.000025   SymDaemon.949
13:03:44.447497  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000016   SymDaemon.950
13:03:44.460196  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data                                                                                    0.000016   SymDaemon.949
13:03:44.461007  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data                                                                                    0.000013   SymDaemon.949
13:03:44.461170  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A1.tok                                                                                                                 0.000048   SymDaemon.949
13:03:44.461202  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A1.tok                                                                                                                 0.000025   SymDaemon.949
13:03:44.491527  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist                                                                                0.000015   SymDaemon.949
13:03:44.573513  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist                                                                                0.000016   SymDaemon.949
13:03:44.573775  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A2.tok                                                                                                                 0.000058   SymDaemon.949
13:03:44.573809  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A2.tok                                                                                                                 0.000026   SymDaemon.949
13:03:44.574809  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:44.575883  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:44.576252  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A3.tok                                                                                                                 0.000042   SymDaemon.949
13:03:44.576283  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A3.tok                                                                                                                 0.000025   SymDaemon.949
13:03:45.729595  open              F=21       (R_____)  /Users/admin/Library/Safari/TopSites.plist                                                                                                                            0.000018   SymDaemon.950
13:03:45.730511  open              F=21       (R_____)  /Users/admin/Library/Safari/LastSession.plist                                                                                                                         0.000013   SymDaemon.950
13:03:45.731245  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.950
13:03:45.731984  open              F=21       (R_____)  /Users/admin/Library/Safari/TopSites.plist                                                                                                                            0.000012   SymDaemon.949
13:03:45.732597  open              F=21       (R_____)  /Users/admin/Library/Safari/TopSites.plist                                                                                                                            0.000012   SymDaemon.949
13:03:45.732782  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A4.tok                                                                                                                 0.000059   SymDaemon.949
13:03:45.732815  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A4.tok                                                                                                                 0.000026   SymDaemon.949
13:03:45.733356  open              F=21       (R_____)  /Users/admin/Library/Safari/LastSession.plist                                                                                                                         0.000012   SymDaemon.949
13:03:45.733971  open              F=21       (R_____)  /Users/admin/Library/Safari/LastSession.plist                                                                                                                         0.000012   SymDaemon.949
13:03:45.734131  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A5.tok                                                                                                                 0.000039   SymDaemon.949
13:03:45.734162  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A5.tok                                                                                                                 0.000024   SymDaemon.949
13:03:45.734750  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000012   SymDaemon.949
13:03:45.735441  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000012   SymDaemon.949
13:03:45.735583  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A6.tok                                                                                                                 0.000039   SymDaemon.949
13:03:45.735613  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A6.tok                                                                                                                 0.000024   SymDaemon.949
13:03:46.029306  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000024   SymDaemon.950
13:03:46.030559  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:46.031369  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:46.031816  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A7.tok                                                                                                                 0.000065   SymDaemon.949
13:03:46.031864  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A7.tok                                                                                                                 0.000027   SymDaemon.949
13:03:47.777930  open              F=21       (R_____)  /Applications/App Store.app                                                                                                                                           0.000025   SymDaemon.8195
13:03:47.778055  open              F=21       (R_____)  /Applications/App Store.app/Contents                                                                                                                                  0.000021   SymDaemon.8195
13:03:47.778160  open              F=21       (R_____)  /Applications/App Store.app/Contents/Info.plist                                                                                                                       0.000026   SymDaemon.8195
13:03:47.778335  open              F=21       (R_____)  /Applications/App Store.app/Contents/PkgInfo                                                                                                                          0.000023   SymDaemon.8195
13:03:48.855144  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000015   SymDaemon.950
13:03:48.856201  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000014   SymDaemon.950
13:03:48.857009  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000012   SymDaemon.950
13:03:48.857642  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.950
13:03:48.858358  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000012   SymDaemon.949
13:03:48.858994  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000012   SymDaemon.949
13:03:48.859262  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A8.tok                                                                                                                 0.000076   SymDaemon.949
13:03:48.859300  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A8.tok                                                                                                                 0.000029   SymDaemon.949
13:03:48.875228  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000015   SymDaemon.949
13:03:48.876250  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000012   SymDaemon.949
13:03:48.876423  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A9.tok                                                                                                                 0.000049   SymDaemon.949
13:03:48.876455  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A9.tok                                                                                                                 0.000025   SymDaemon.949
13:03:48.990642  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000017   SymDaemon.949
13:03:48.992131  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000021   SymDaemon.949
13:03:48.992491  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AA.tok                                                                                                                 0.000159   SymDaemon.949
13:03:48.992531  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AA.tok                                                                                                                 0.000031   SymDaemon.949
13:03:48.993716  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000018   SymDaemon.949
13:03:49.014390  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db                                              0.000026   SymDaemon.950
13:03:49.018088  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db                                           0.000013   SymDaemon.950
13:03:49.019323  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000014   SymDaemon.950
13:03:49.020241  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000012   SymDaemon.950
13:03:49.021168  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db                                                                          0.000014   SymDaemon.950
13:03:49.022086  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db                                                                       0.000013   SymDaemon.950
13:03:49.105892  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.949
13:03:49.106098  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AB.tok                                                                                                                 0.000051   SymDaemon.949
13:03:49.106131  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AB.tok                                                                                                                 0.000026   SymDaemon.949
13:03:49.107452  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db                                              0.000151 W SymDaemon.949
13:03:49.108899  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db                                              0.000014   SymDaemon.949
13:03:49.109316  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AC.tok                                                                                                                 0.000048   SymDaemon.949
13:03:49.109349  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AC.tok                                                                                                                 0.000025   SymDaemon.949
13:03:49.261103  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db                                           0.000014   SymDaemon.949
13:03:49.262318  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db                                           0.000014   SymDaemon.949
13:03:49.262840  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AD.tok                                                                                                                 0.000070   SymDaemon.949
13:03:49.262874  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AD.tok                                                                                                                 0.000027   SymDaemon.949
13:03:49.318982  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000017   SymDaemon.949
13:03:49.320177  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000013   SymDaemon.949
13:03:49.320595  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AE.tok                                                                                                                 0.000054   SymDaemon.949
13:03:49.320627  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AE.tok                                                                                                                 0.000025   SymDaemon.949
13:03:49.469812  open              F=22       (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions                                                                                                      0.000011   SymDaemon.8196
13:03:49.469954  open              F=22       (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions                                                                                                      0.000010   SymDaemon.8196
13:03:49.470041  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Contents>>>>>>>>>>>>>>>                                                                              0.000009   SymDaemon.8196
13:03:49.470059  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Support Files>>>>>>>>>>                                                                              0.000008   SymDaemon.8196
13:03:49.470074  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/PkgInfo                                                                                              0.000007   SymDaemon.8196
13:03:49.498642  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000016   SymDaemon.949
13:03:49.499790  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.949
13:03:49.500309  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AF.tok                                                                                                                 0.000053   SymDaemon.949
13:03:49.500341  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AF.tok                                                                                                                 0.000025   SymDaemon.949
13:03:49.505639  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db                                                                          0.000017   SymDaemon.949
13:03:49.507048  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db                                                                          0.000017   SymDaemon.949
13:03:49.507494  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B0.tok                                                                                                                 0.000066   SymDaemon.949
13:03:49.507528  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B0.tok                                                                                                                 0.000027   SymDaemon.949
13:03:49.509300  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db                                                                       0.000014   SymDaemon.949
13:03:49.510396  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db                                                                       0.000013   SymDaemon.949
13:03:49.510891  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B1.tok                                                                                                                 0.000045   SymDaemon.949
13:03:49.510923  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B1.tok                                                                                                                 0.000024   SymDaemon.949
13:03:49.530932  open              F=21       (R_____)  /System/Library/CoreServices/ManagedClient.app                                                                                                                        0.000010   SymDaemon.8195
13:03:49.531013  open              F=21       (R_____)  /System/Library/CoreServices/ManagedClient.app/Contents                                                                                                               0.000011   SymDaemon.8195
13:03:49.531102  open              F=21       (R_____)  /System/Library/CoreServices/ManagedClient.app/Contents/Info.plist                                                                                                    0.000022   SymDaemon.8195
13:03:49.531224  open              F=21       (R_____)  /System/Library/CoreServices/ManagedClient.app/Contents/PkgInfo                                                                                                       0.000023   SymDaemon.8195
13:03:50.949531  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000022   SymDaemon.950
13:03:50.952195  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000029   SymDaemon.949
13:03:50.953736  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000022   SymDaemon.949
13:03:50.954603  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B2.tok                                                                                                                 0.000074   SymDaemon.949
13:03:50.954640  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B2.tok                                                                                                                 0.000028   SymDaemon.949
13:03:51.013404  open              F=23       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000027   SymDaemon.950
13:03:51.014626  open              F=23       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.950
13:03:51.015468  open              F=23       (R_____)  /Users/admin/Library/Caches/com.apple.storeagent/updates.plist                                                                                                        0.000014   SymDaemon.950
13:03:51.016121  open              F=23       (R_____)  /Users/admin/Library/Cookies/com.apple.appstore.cookies                                                                                                               0.000013   SymDaemon.950
13:03:51.016751  open              F=23       (R_____)  /Library/Application Support/App Store/adoption.plist                                                                                                                 0.000013   SymDaemon.950
13:03:51.017400  open              F=23       (R_____)  /private/var/db/launchd.db/com.apple.launchd/overrides.plist                                                                                                          0.000013   SymDaemon.950
13:03:51.018014  open              F=23       (R_____)  /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist                                                                                       0.000025   SymDaemon.950
13:03:51.019227  open              F=23       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist                                                                         0.000014   SymDaemon.950
13:03:51.047127  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist                                                                         0.000017   SymDaemon.950
13:03:51.048112  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist                                                                       0.000013   SymDaemon.950
13:03:51.048859  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.nsservicescache.plist                                                                                                           0.000013   SymDaemon.950
13:03:51.050043  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000013   SymDaemon.949
13:03:51.050852  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:51.051252  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B3.tok                                                                                                                 0.000054   SymDaemon.949
13:03:51.051284  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B3.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.074181  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.949
13:03:51.075109  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000012   SymDaemon.949
13:03:51.075291  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B4.tok                                                                                                                 0.000045   SymDaemon.949
13:03:51.075323  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B4.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.094970  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.storeagent/updates.plist                                                                                                        0.000016   SymDaemon.949
13:03:51.095786  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.storeagent/updates.plist                                                                                                        0.000013   SymDaemon.949
13:03:51.095970  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B5.tok                                                                                                                 0.000052   SymDaemon.949
13:03:51.096002  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B5.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.127147  open              F=21       (R_____)  /Users/admin/Library/Cookies/com.apple.appstore.cookies                                                                                                               0.000016   SymDaemon.949
13:03:51.127955  open              F=21       (R_____)  /Users/admin/Library/Cookies/com.apple.appstore.cookies                                                                                                               0.000012   SymDaemon.949
13:03:51.128160  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B6.tok                                                                                                                 0.000053   SymDaemon.949
13:03:51.128192  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B6.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.145362  open              F=21       (R_____)  /Library/Application Support/App Store/adoption.plist                                                                                                                 0.000014   SymDaemon.949
13:03:51.146177  open              F=21       (R_____)  /Library/Application Support/App Store/adoption.plist                                                                                                                 0.000012   SymDaemon.949
13:03:51.146259  open              F=22       (R_____)  /Library/Application Support/App Store/adoption.plist                                                                                                                 0.000012   SymDaemon.949
13:03:51.146436  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B7.tok                                                                                                                 0.000050   SymDaemon.949
13:03:51.146467  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B7.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.164358  open              F=21       (R_____)  /private/var/db/launchd.db/com.apple.launchd/overrides.plist                                                                                                          0.000016   SymDaemon.949
13:03:51.165194  open              F=21       (R_____)  /private/var/db/launchd.db/com.apple.launchd/overrides.plist                                                                                                          0.000012   SymDaemon.949
13:03:51.165264  open              F=22       (R_____)  /private/var/db/launchd.db/com.apple.launchd/overrides.plist                                                                                                          0.000012   SymDaemon.949
13:03:51.165435  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B8.tok                                                                                                                 0.000052   SymDaemon.949
13:03:51.165466  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B8.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.179368  open              F=21       (R_____)  /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist                                                                                       0.000026   SymDaemon.949
13:03:51.180143  open              F=21       (R_____)  /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist                                                                                       0.000021   SymDaemon.949
13:03:51.180216  open              F=22       (R_____)  /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist                                                                                       0.000020   SymDaemon.949
13:03:51.180391  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B9.tok                                                                                                                 0.000047   SymDaemon.949
13:03:51.180421  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B9.tok                                                                                                                 0.000024   SymDaemon.949
13:03:51.241986  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist                                                                         0.000014   SymDaemon.949
13:03:51.243114  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist                                                                         0.000012   SymDaemon.949
13:03:51.243706  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BA.tok                                                                                                                 0.000058   SymDaemon.949
13:03:51.243739  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BA.tok                                                                                                                 0.000026   SymDaemon.949
13:03:51.463647  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist                                                                         0.000016   SymDaemon.949
13:03:51.464705  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist                                                                         0.000013   SymDaemon.949
13:03:51.464935  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BB.tok                                                                                                                 0.000053   SymDaemon.949
13:03:51.465020  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BB.tok                                                                                                                 0.000079   SymDaemon.949
13:03:51.468332  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist                                                                       0.000014   SymDaemon.949
13:03:51.469153  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist                                                                       0.000013   SymDaemon.949
13:03:51.469393  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BC.tok                                                                                                                 0.000044   SymDaemon.949
13:03:51.469423  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BC.tok                                                                                                                 0.000024   SymDaemon.949
13:03:51.474846  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.nsservicescache.plist                                                                                                           0.000013   SymDaemon.949
13:03:51.477227  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.nsservicescache.plist                                                                                                           0.000018   SymDaemon.949
13:03:51.477536  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BD.tok                                                                                                                 0.000071   SymDaemon.949
13:03:51.477573  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BD.tok                                                                                                                 0.000029   SymDaemon.949
13:03:53.387589  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library.itl                                                                                                                          0.000025   SymDaemon.950
13:03:53.391003  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Extras.itdb                                                                                                                  0.000014   SymDaemon.950
13:03:53.392889  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000013   SymDaemon.950
13:03:53.393453  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library.itl                                                                                                                          0.000012   SymDaemon.949
13:03:53.397652  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library.itl                                                                                                                          0.000013   SymDaemon.949
13:03:53.398128  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BE.tok                                                                                                                 0.000063   SymDaemon.949
13:03:53.398163  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BE.tok                                                                                                                 0.000027   SymDaemon.949
13:03:53.399048  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Extras.itdb                                                                                                                  0.000012   SymDaemon.949
13:03:53.400789  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Extras.itdb                                                                                                                  0.000012   SymDaemon.949
13:03:53.401775  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BF.tok                                                                                                                 0.000041   SymDaemon.949
13:03:53.401806  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BF.tok                                                                                                                 0.000025   SymDaemon.949
13:03:53.403029  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000012   SymDaemon.949
13:03:53.403542  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000012   SymDaemon.949
13:03:53.403666  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C0.tok                                                                                                                 0.000038   SymDaemon.949
13:03:53.403696  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C0.tok                                                                                                                 0.000024   SymDaemon.949
13:04:00.547142  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000024   SymDaemon.950
13:04:00.548411  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:04:00.549268  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000012   SymDaemon.949
13:04:00.549465  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C1.tok                                                                                                                 0.000060   SymDaemon.949
13:04:00.549499  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C1.tok                                                                                                                 0.000026   SymDaemon.949
13:04:03.157699  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000025   SymDaemon.950
13:04:03.158584  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000013   SymDaemon.950
13:04:03.159448  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.950
13:04:03.160108  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000013   SymDaemon.950
13:04:03.161050  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.appstore.plist                                                                                                             0.000013   SymDaemon.950
13:04:03.161717  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.storeagent.plist                                                                                                           0.000013   SymDaemon.950
13:04:03.162340  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000012   SymDaemon.949
13:04:03.162976  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000012   SymDaemon.949
13:04:03.163193  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C2.tok                                                                                                                 0.000066   SymDaemon.949
13:04:03.163227  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C2.tok                                                                                                                 0.000026   SymDaemon.949
13:04:03.163702  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000012   SymDaemon.949
13:04:03.164429  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000012   SymDaemon.949
13:04:03.164572  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C3.tok                                                                                                                 0.000039   SymDaemon.949
13:04:03.164603  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C3.tok                                                                                                                 0.000024   SymDaemon.949
13:04:03.173689  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.949
13:04:03.175251  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.949
13:04:03.175413  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C4.tok                                                                                                                 0.000043   SymDaemon.949
13:04:03.175444  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C4.tok                                                                                                                 0.000024   SymDaemon.949
13:04:03.175838  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000012   SymDaemon.949
13:04:03.176725  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000012   SymDaemon.949
13:04:03.176865  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C5.tok                                                                                                                 0.000039   SymDaemon.949
13:04:03.176907  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C5.tok                                                                                                                 0.000036   SymDaemon.949
13:04:03.177854  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.appstore.plist                                                                                                             0.000012   SymDaemon.949
13:04:03.178457  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.appstore.plist                                                                                                             0.000012   SymDaemon.949
13:04:03.178620  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C6.tok                                                                                                                 0.000039   SymDaemon.949
13:04:03.178651  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C6.tok                                                                                                                 0.000024   SymDaemon.949
13:04:03.179437  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.storeagent.plist                                                                                                           0.000012   SymDaemon.949
13:04:03.180003  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.storeagent.plist                                                                                                           0.000012   SymDaemon.949
13:04:03.180137  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C7.tok                                                                                                                 0.000038   SymDaemon.949
13:04:03.180167  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C7.tok                                                                                                                 0.000024   SymDaemon.949
13:04:10.997639  open              F=21       (R_____)  /Users/admin/Desktop/OFF.log                                                                                                                                          0.000024   SymDaemon.950
13:04:10.998761  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db-wal                                                                                                                      0.000014   SymDaemon.950
13:04:10.999343  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db                                                                                                                          0.000013   SymDaemon.950
13:04:11.001468  open              F=21       (R_____)  /Users/admin/Desktop/OFF.log                                                                                                                                          0.000012   SymDaemon.949
13:04:11.002370  open              F=21       (R_____)  /Users/admin/Desktop/OFF.log                                                                                                                                          0.000012   SymDaemon.949
13:04:11.002449  open              F=22       (R_____)  /Users/admin/Desktop/OFF.log                                                                                                                                          0.000012   SymDaemon.949
13:04:11.002655  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C8.tok                                                                                                                 0.000068   SymDaemon.949
13:04:11.002688  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C8.tok                                                                                                                 0.000026   SymDaemon.949
13:04:11.045240  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db-wal                                                                                                                      0.000014   SymDaemon.949
13:04:11.045786  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db-wal                                                                                                                      0.000012   SymDaemon.949
13:04:11.045946  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db                                                                                                                          0.000012   SymDaemon.949
13:04:11.049096  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db                                                                                                                          0.000012   SymDaemon.949
13:04:11.050999  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C9.tok                                                                                                                 0.000051   SymDaemon.949
13:04:11.051031  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C9.tok                      

Below is an example from an idle Macintosh, filtered on open operations, where Auto-Protect scanning of compressed files is disabled:

12:59:12.200034  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000026   SymDaemon.950
12:59:13.788970  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data                                                                                  0.000025   SymDaemon.950
12:59:13.791806  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist                                                                              0.000014   SymDaemon.950
12:59:14.866217  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000028   SymDaemon.950
12:59:20.881158  open              F=20       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000025   SymDaemon.950
12:59:28.180117  open              F=20       (R_____)  /private/var/db/systemstats/snapshots.db-wal                                                                                                                          0.000026   SymDaemon.950
12:59:28.180971  open              F=20       (R_____)  /private/var/db/systemstats/snapshots.db                                                                                                                              0.000013   SymDaemon.950
12:59:45.493017  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000025   SymDaemon.950
12:59:45.494278  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.950
13:00:02.824416  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000028   SymDaemon.950
13:00:12.177829  open              F=20       (R_____)  /Applications/Safari.app                                                                                                                                              0.000030   SymDaemon.7119
13:00:12.180053  open              F=20       (R_____)  /Applications/Safari.app/Contents                                                                                                                                     0.000026   SymDaemon.7119
13:00:12.180168  open              F=20       (R_____)  /Applications/Safari.app/Contents/Info.plist                                                                                                                          0.000028   SymDaemon.7119
13:00:12.180667  open              F=20       (R_____)  /Applications/Safari.app/Contents/PkgInfo                                                                                                                             0.000024   SymDaemon.7119
13:00:12.626987  open              F=20       (R_____)  /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app                                                                                      0.000013   SymDaemon.7119
13:00:12.627083  open              F=20       (R_____)  /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents                                                                             0.000012   SymDaemon.7119
13:00:12.627177  open              F=20       (R_____)  /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/Info.plist                                                                  0.000027   SymDaemon.7119
13:00:12.627332  open              F=20       (R_____)  /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/PkgInfo                                                                     0.000023   SymDaemon.7119
13:00:13.085954  open              F=20       (R_____)  A/Frameworks/LaunchServices.framework                                                                                                                                 0.000018   SymDaemon.7119
13:00:13.086077  open              F=20       (R_____)  A/Resources                                                                                                                                                           0.000018   SymDaemon.7119
13:00:13.086376  open              F=20       (R_____)  A/Resources/Info.plist                                                                                                                                                0.000052   SymDaemon.7119
13:00:13.089136  open                   [  2] (R_____)  A/Frameworks/LaunchServices.framework/Contents>>>>>>>>>>                                                                                                              0.000013   SymDaemon.7119
13:00:13.089158  open                   [  2] (R_____)  A/Frameworks/LaunchServices.framework/Support Files>>>>>                                                                                                              0.000011   SymDaemon.7119
13:00:13.089177  open                   [  2] (R_____)  A/Frameworks/LaunchServices.framework/PkgInfo                                                                                                                         0.000010   SymDaemon.7119
13:00:13.089346  open              F=20       (R_____)  /System                                                                                                                                                               0.000020   SymDaemon.7119
13:00:13.089476  open              F=20       (R_____)  /System                                                                                                                                                               0.000009   SymDaemon.7119
13:00:13.089543  open                   [  2] (R_____)  /System/Contents>>>>>>>>                                                                                                                                              0.000007   SymDaemon.7119
13:00:13.089558  open                   [  2] (R_____)  /System/Support Files>>>                                                                                                                                              0.000007   SymDaemon.7119
13:00:13.089571  open                   [  2] (R_____)  /System/PkgInfo                                                                                                                                                       0.000006   SymDaemon.7119
13:00:13.273182  open              F=20       (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework                                                                                                            0.000011   SymDaemon.7119
13:00:13.289982  open              F=20       (R_____)  A/Resources                                                                                                                                                           0.000017   SymDaemon.7119
13:00:13.290069  open              F=20       (R_____)  A/Resources/Info.plist                                                                                                                                                0.000027   SymDaemon.7119
13:00:13.290508  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/Contents>>>>>>>>>>>>>>>>>>>>>                                                                              0.000009   SymDaemon.7119
13:00:13.290525  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support Files>>>>>>>>>>>>>>>>                                                                              0.000008   SymDaemon.7119
13:00:13.290540  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/PkgInfo                                                                                                    0.000007   SymDaemon.7119
13:00:14.012005  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000022   SymDaemon.950
13:00:14.013483  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.PubSubAgent.plist                                                                                                          0.000013   SymDaemon.950
13:00:14.014209  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000013   SymDaemon.950
13:00:15.048007  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore                                                                      0.000016   SymDaemon.950
13:00:15.049234  open              F=20       (R_____)  /Users/admin/Library/SyncedPreferences/com.apple.syncedpreferences.plist                                                                                              0.000014   SymDaemon.950
13:00:15.050043  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.Safari/com.apple.sandbox/sandbox-cache.db                              0.000014   SymDaemon.950
13:00:15.051103  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.IconServices/6100D2A3FF19F8B18C1B86F91DBC3BC5.iscachebmp                                           0.000013   SymDaemon.950
13:00:16.050942  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.Networking+com.apple.Safari/com.apple.sandbox/sandbox-cache.db                              0.000022   SymDaemon.950
13:00:17.140451  open              F=20       (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions                                                                                                               0.000015   SymDaemon.7119
13:00:17.157535  open              F=20       (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions                                                                                                               0.000013   SymDaemon.7119
13:00:17.160556  open                   [  2] (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions/Contents>>>>>>>>>>>>>>>>>>>>>>>>                                                                              0.000011   SymDaemon.7119
13:00:17.160573  open                   [  2] (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions/Support Files>>>>>>>>>>>>>>>>>>>                                                                              0.000007   SymDaemon.7119
13:00:17.160597  open                   [  2] (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions/PkgInfo                                                                                                       0.000016   SymDaemon.7119
13:00:17.218248  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000031   SymDaemon.950
13:00:17.219648  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.950
13:00:17.220892  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000013   SymDaemon.950
13:00:19.005893  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000024   SymDaemon.950
13:00:19.011780  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000016   SymDaemon.950
13:00:19.012747  open              F=20       (R_____)  /Users/admin/Library/Preferences/.GlobalPreferences.plist                                                                                                             0.000013   SymDaemon.950
13:00:19.013460  open              F=20       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.950
13:00:19.014525  open              F=20       (R_____)  /Users/admin/Library/Safari/Configurations.plist.signed                                                                                                               0.000013   SymDaemon.950
13:00:19.015608  open              F=20       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000029   SymDaemon.950
13:00:19.077770  open              F=20       (R_____)  /Users/admin/Library/PubSub/Clients.plist                                                                                                                             0.000013   SymDaemon.950
13:00:19.802168  open              F=20       (R_____)  /Applications/Safari.app                                                                                                                                              0.000024   SymDaemon.7149
13:00:19.802274  open              F=20       (R_____)  /Applications/Safari.app/Contents                                                                                                                                     0.000020   SymDaemon.7149
13:00:19.802384  open              F=20       (R_____)  /Applications/Safari.app/Contents/Info.plist                                                                                                                          0.000028   SymDaemon.7149
13:00:19.802887  open              F=20       (R_____)  /Applications/Safari.app/Contents/PkgInfo                                                                                                                             0.000023   SymDaemon.7149
13:00:21.769278  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.help.plist                                                                                                                 0.000029   SymDaemon.950
13:00:21.770498  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000013   SymDaemon.950
13:00:21.771249  open              F=20       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist                                                                                           0.000014   SymDaemon.950
13:00:21.773267  open              F=20       (R_____)  /Users/admin/Library/Preferences/QuickTime Preferences                                                                                                                0.000014   SymDaemon.950
13:00:21.774499  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.quicktime.plugin.preferences.plist                                                                                         0.000014   SymDaemon.950
13:00:21.775551  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/77C0C2D0-E042-437A-9100-D27CA7FD2425.webbookmark                                                                0.000013   SymDaemon.950
13:00:21.777461  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/C6031387-61B7-49B1-8A9A-D7C6C87DE78D.webbookmark                                                                0.000015   SymDaemon.950
13:00:21.778163  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/83EEF489-E547-42F6-863B-354E93A680A2.webbookmark                                                                0.000013   SymDaemon.950
13:00:21.778786  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/47035D3E-FDF5-48F1-B517-F0A00E521C07.webbookmark                                                                0.000014   SymDaemon.950
13:00:22.181192  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/B4B283AB-C684-47CA-9B1F-8C4F06B21572.webbookmark                                                                0.000017   SymDaemon.950
13:00:22.182105  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/6B057C96-609F-4B63-8E37-14FA085A1C4C.webbookmark                                                                0.000014   SymDaemon.950
13:00:22.182768  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/3FCC16BB-E56A-4DB5-8941-33170A67B99F.webbookmark                                                                0.000014   SymDaemon.950
13:00:22.183478  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/402ADB1C-C3C0-4CD1-8158-B45C4D8E438C.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.184158  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/CCDEA395-8D07-4670-8308-1471D7793EB1.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.184815  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/E5DDF305-0348-4C54-8D36-B165C79984D8.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.186045  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/3CDDF82B-8590-4963-9D41-066DB0574505.webbookmark                                                                0.000014   SymDaemon.950
13:00:22.186705  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/62A98F7F-5C73-497C-AC5A-B48FE618D404.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.187574  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/DA234375-1282-4BC8-81D8-25EA4B638E69.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.188271  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/9B6374E2-DA43-4F4C-BDA0-BF382E17521F.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.188939  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/6D51CBD4-03FA-4370-AD96-CF956F2D17BF.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.189558  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/C3248BD4-C35F-48F4-B58F-A6D6EE78BE1E.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.190367  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/78C8B380-4513-455B-B6DF-AD0B83043243.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.191011  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/2817963C-D664-42D1-89C5-B8C8912CADCB.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.191652  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/96441F34-A8FD-46D9-A524-7050100186A0.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.201184  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/93915673-0C21-4AC6-A67B-7F9D4B9A5559.webbookmark                                                                0.000015   SymDaemon.950
13:00:22.201955  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data                                                                                    0.000013   SymDaemon.950
13:00:22.202907  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist                                                                                0.000013   SymDaemon.950
13:00:22.361589  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000018   SymDaemon.950
13:00:23.187710  open              F=20       (R_____)  /System                                                                                                                                                               0.000026   SymDaemon.7119
13:00:23.187866  open              F=20       (R_____)  /System                                                                                                                                                               0.000009   SymDaemon.7119
13:00:23.187953  open                   [  2] (R_____)  /System/Contents>>>>>>>>                                                                                                                                              0.000008   SymDaemon.7119
13:00:23.187971  open                   [  2] (R_____)  /System/Support Files>>>                                                                                                                                              0.000007   SymDaemon.7119
13:00:23.187985  open                   [  2] (R_____)  /System/PkgInfo                                                                                                                                                       0.000007   SymDaemon.7119
13:00:25.062208  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/75B9C4C4-FA40-4489-ABEA-FFB4221D1F8E                                                                        0.000027   SymDaemon.950
13:00:25.063510  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore                                                                      0.000014   SymDaemon.950
13:00:25.064300  open              F=20       (R_____)  /Users/admin/Library/Safari/TopSites.plist                                                                                                                            0.000013   SymDaemon.950
13:00:25.065020  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/index.sqlite                                                              0.000014   SymDaemon.950
13:00:27.514080  open              F=20       (R_____)  /Users/admin/Library/Safari/WebpageIcons.db                                                                                                                           0.000028   SymDaemon.950
13:00:27.516109  open              F=20       (R_____)  /Users/admin/Library/Safari/LastSession.plist                                                                                                                         0.000014   SymDaemon.950
13:00:27.516849  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/580F555A-AD45-424B-9320-D743D877F596                                                                        0.000014   SymDaemon.950
13:00:27.517500  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/0A9C8198-8A19-43AD-A8FD-C598DCC46470                                                                        0.000013   SymDaemon.950
13:00:27.518067  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/FDBB7D0E-E4BC-4A29-97D7-9614754CE29C                                                                        0.000014   SymDaemon.950
13:00:27.518634  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/A66DFC9E-8067-49CA-889B-6C16C500DCD7                                                                        0.000013   SymDaemon.950
13:00:27.519947  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/21417647-DC56-4651-ADD2-C7024403FDCF                                                                        0.000014   SymDaemon.950
13:00:27.521247  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/2DE01F36-F367-4FBA-9804-A3AFC0B69A77                                                                        0.000013   SymDaemon.950
13:00:28.072682  open              F=20       (R_____)  /Applications/iTunes.app                                                                                                                                              0.000034   SymDaemon.7119
13:00:28.072798  open              F=20       (R_____)  /Applications/iTunes.app/Contents                                                                                                                                     0.000021   SymDaemon.7119
13:00:28.072908  open              F=20       (R_____)  /Applications/iTunes.app/Contents/Info.plist                                                                                                                          0.000028   SymDaemon.7119
13:00:28.073588  open              F=20       (R_____)  /Applications/iTunes.app/Contents/PkgInfo                                                                                                                             0.000024   SymDaemon.7119
13:00:28.074136  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/569AB7AC-CB4B-40A5-8F6F-C25F35360D23                                                                        0.000014   SymDaemon.950
13:00:28.075656  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/4A448E90-0FAD-40F9-9D9E-05C69D2522EE                                                                        0.000014   SymDaemon.950
13:00:28.076330  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/436642F8-8345-4886-9183-EE2986D0E2EA                                                                        0.000013   SymDaemon.950
13:00:28.077520  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/09EB8C21-D2E6-4B1A-9A33-03999679763B                                                                        0.000013   SymDaemon.950
13:00:28.078199  open              F=20       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist                                                                         0.000013   SymDaemon.950
13:00:28.079107  open              F=20       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist                                                                         0.000013   SymDaemon.950
13:00:28.079958  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.nsservicescache.plist                                                                                                           0.000013   SymDaemon.950
13:00:28.080919  open              F=20       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.950
13:00:30.134883  open              F=20       (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions                                                                                                      0.000016   SymDaemon.7119
13:00:30.135032  open              F=20       (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions                                                                                                      0.000010   SymDaemon.7119
13:00:30.135106  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Contents>>>>>>>>>>>>>>>                                                                              0.000009   SymDaemon.7119
13:00:30.135124  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Support Files>>>>>>>>>>                                                                              0.000007   SymDaemon.7119
13:00:30.135139  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/PkgInfo                                                                                              0.000008   SymDaemon.7119
13:00:30.135477  open              F=20       (R_____)  /Users/admin/Library/Caches/QCCompositionRepository-com.apple.iTunes.cache                                                                                            0.000014   SymDaemon.950
13:00:30.136715  open              F=20       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000013   SymDaemon.950
13:00:30.138054  open              F=20       (R_____)  /Users/admin/Music/iTunes/iTunes Library Genius.itdb                                                                                                                  0.000012   SymDaemon.950
13:00:30.168215  open              F=20       (R_____)  private/var/log/system.log                                                                                                                                            0.000022   SymDaemon.7149
13:00:31.008865  open              F=21       (R_____)  /Users/admin/Library/Containers/com.apple.BKAgentService/Container.plist                                                                                              0.000015   SymDaemon.950
13:00:31.010139  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.950
13:00:32.789758  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.sandbox/sandbox-cache.db                                                                           0.000019   SymDaemon.950
13:00:32.805909  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/.iTunes Preferences.plist                                                                                                      0.000016   SymDaemon.950
13:00:32.808049  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ar.strings                                                                    0.000031   SymDaemon.950
13:00:32.808772  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ca.strings                                                                    0.000028   SymDaemon.950
13:00:32.809719  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/cs.strings                                                                    0.000029   SymDaemon.950
13:00:32.810409  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/da.strings                                                                    0.000028   SymDaemon.950
13:00:32.811159  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Dutch.strings                                                                 0.000029   SymDaemon.950
13:00:32.811843  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/el.strings                                                                    0.000042   SymDaemon.950
13:00:32.812505  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/en_GB.strings                                                                 0.000028   SymDaemon.950
13:00:32.813186  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/English.strings                                                               0.000028   SymDaemon.950
13:00:32.813833  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/fi.strings                                                                    0.000039   SymDaemon.950
13:00:32.814507  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/French.strings                                                                0.000028   SymDaemon.950
13:00:32.815374  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/German.strings                                                                0.000028   SymDaemon.950
13:00:32.816054  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/he.strings                                                                    0.000029   SymDaemon.950
13:00:32.816753  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/hr.strings                                                                    0.000028   SymDaemon.950
13:00:32.817638  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/hu.strings                                                                    0.000028   SymDaemon.950
13:00:32.818330  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/id.strings                                                                    0.000029   SymDaemon.950
13:00:32.820483  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Italian.strings                                                               0.000031   SymDaemon.950
13:00:32.821200  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Japanese.strings                                                              0.000029   SymDaemon.950
13:00:32.821889  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ko.strings                                                                    0.000028   SymDaemon.950
13:00:32.822581  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ms.strings                                                                    0.000027   SymDaemon.950
13:00:32.823278  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/no.strings                                                                    0.000029   SymDaemon.950
13:00:32.823948  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pl.strings                                                                    0.000028   SymDaemon.950
13:00:32.824654  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pt.strings                                                                    0.000027   SymDaemon.950
13:00:32.825612  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pt_PT.strings                                                                 0.000031   SymDaemon.950
13:00:32.826292  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ro.strings                                                                    0.000028   SymDaemon.950
13:00:32.826983  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ru.strings                                                                    0.000028   SymDaemon.950
13:00:32.827654  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/sk.strings                                                                    0.000027   SymDaemon.950
13:00:32.828318  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Spanish.strings                                                               0.000029   SymDaemon.950
13:00:32.828999  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/sv.strings                                                                    0.000028   SymDaemon.950
13:00:32.829660  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/th.strings                                                                    0.000028   SymDaemon.950
13:00:32.830343  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/tr.strings                                                                    0.000028   SymDaemon.950
13:00:32.831095  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/uk.strings                                                                    0.000028   SymDaemon.950
13:00:32.831760  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/vi.strings                                                                    0.000028   SymDaemon.950
13:00:32.832441  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/zh_CN.strings                                                                 0.000028   SymDaemon.950
13:00:32.833108  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/zh_TW.strings                                                                 0.000028   SymDaemon.950
13:00:32.833797  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000014   SymDaemon.950
13:00:32.834776  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000012   SymDaemon.950
13:00:33.171149  open              F=21       (R_____)  /System                                                                                                                                                               0.000026   SymDaemon.7149
13:00:33.171310  open              F=21       (R_____)  /System                                                                                                                                                               0.000009   SymDaemon.7149
13:00:33.171384  open                   [  2] (R_____)  /System/Contents>>>>>>>>                                                                                                                                              0.000007   SymDaemon.7149
13:00:33.171401  open                   [  2] (R_____)  /System/Support Files>>>                                                                                                                                              0.000007   SymDaemon.7149
13:00:33.171415  open                   [  2] (R_____)  /System/PkgInfo                                                                                                                                                       0.000007   SymDaemon.7149
13:00:33.173378  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000016   SymDaemon.950
13:00:33.174561  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000013   SymDaemon.950
13:00:33.175599  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000013   SymDaemon.950
13:00:33.176470  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000013   SymDaemon.950
13:00:33.177131  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000014   SymDaemon.950
13:00:33.178044  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist                                                                                           0.000019   SymDaemon.950
13:00:33.179497  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000018   SymDaemon.950
13:00:33.180746  open              F=21       (R_____)  /Users/admin/Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/Books.plist                                                                      0.000014   SymDaemon.950
13:00:33.182208  open              F=21       (R_____)  /Users/admin/Library/Cookies/com.apple.ibooks.cookies                                                                                                                 0.000013   SymDaemon.950
13:00:33.182840  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.bookstoreagent.plist                                                                                                       0.000013   SymDaemon.950
13:00:35.179280  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore                                                                      0.000017   SymDaemon.950
13:00:35.180362  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library.itl                                                                                                                          0.000013   SymDaemon.950
13:00:35.185564  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.loginitems.plist                                                                                                           0.000015   SymDaemon.950
13:00:35.186232  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Music Library.xml                                                                                                                    0.000013   SymDaemon.950
13:00:35.948335  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000014   SymDaemon.7119
13:00:35.948503  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000012   SymDaemon.7119
13:00:35.948581  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Contents>>>>>>>                                                                                                              0.000012   SymDaemon.7119
13:00:35.948601  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Support Files>>                                                                                                              0.000010   SymDaemon.7119
13:00:35.948625  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/PkgInfo                                                                                                                      0.000016   SymDaemon.7119
13:00:36.265471  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iApps.plist                                                                                                                0.000027   SymDaemon.950
13:00:36.266371  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Extras.itdb                                                                                                                  0.000013   SymDaemon.950
13:00:36.267276  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Genius.itdb                                                                                                                  0.000013   SymDaemon.950
13:00:36.268298  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000013   SymDaemon.950
13:00:36.268894  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.eq.plist                                                                                                            0.000024   SymDaemon.950
13:00:36.269742  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.950
13:00:44.647426  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000027   SymDaemon.950
13:00:48.130293  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000026   SymDaemon.950
13:00:48.131366  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist                                                                                           0.000013   SymDaemon.950
13:00:48.132192  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.bookstoreagent.plist                                                                                                       0.000013   SymDaemon.950
13:00:48.132858  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.950
13:00:48.133479  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000012   SymDaemon.950
13:00:49.012579  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000014   SymDaemon.7119
13:00:49.012727  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000012   SymDaemon.7119
13:00:49.012804  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Contents>>>>>>>                                                                                                              0.000011   SymDaemon.7119
13:00:49.012836  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Support Files>>                                                                                                              0.000022   SymDaemon.7119
13:00:49.012854  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/PkgInfo                                                                                                                      0.000010   SymDaemon.7119
13:00:49.016564  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000013   SymDaemon.7119
13:00:49.016698  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000012   SymDaemon.7119
13:00:49.016772  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Contents>>>>>>>                                                                                                              0.000011   SymDaemon.7119
13:00:49.016792  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Support Files>>                                                                                                              0.000010   SymDaemon.7119
13:00:49.016810  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/PkgInfo                                                                                                                      0.000010   SymDaemon.7119
13:00:58.131598  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000025   SymDaemon.950