Mac の fs_usage コマンドラインを使用してファイルの動作をトレースする

book

Article ID: 241947

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

fs_usage コマンドラインを使用して Symantec Endpoint Protection (SEP) ファイルの動作をトレースしたい。

Resolution

Mac のターミナルアプリケーションで以下のコマンドを実行します。

sudo -b fs_usage -w -f pathname SymDaemon > ~/Desktop/symdaemon.log

このコマンドによりバックグラウンドで fs_usage が実行され、ファイルのパス名を含むすべての SymDaemon の操作がログに記録されます。デスクトップ上の symdaemon.log をダブルクリックすると、mac のコンソールアプリケーションを使って内容をリアルタイムに見ることができます。
Mac コンソールアプリケーションは、ウィンドウの右上にある [検索] エリアに入力した文字列と一致する行だけを含むように、ログの表示をフィルタリングすることもできます。また、フィルタリングされたビューを新しいログファイルに保存することもできます。例えば eicar テストファイルに対するすべてのオープン操作の記録のみが必要な場合、[検索] エリアに "open eicar" と入力してください。

fs_usage の実行中に、ターミナル コマンド ラインに次のように入力すると、ログ ファイルを空にして再起動することができます。

> ~/Desktop/symdaemon.log

ログを停止する準備ができたら、次のように入力します。

sudo killall fs_usage

以下はアイドル状態の Mac からのログファイルの例で、オープン操作のみを表示するようにフィルタリングされています。圧縮ファイルの自動保護スキャンが有効になっています。

13:02:34.268072  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008E.tok                                                                                                                 0.000070   SymDaemon.949
13:02:34.268108  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008E.tok                                                                                                                 0.000028   SymDaemon.949
13:02:39.034659  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000016   SymDaemon.950
13:02:39.035545  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:39.036117  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:39.036208  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:39.036437  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008F.tok                                                                                                                 0.000051   SymDaemon.949
13:02:39.036469  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008F.tok                                                                                                                 0.000026   SymDaemon.949
13:02:41.235027  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000026   SymDaemon.950
13:02:41.235919  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:41.236492  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:41.236562  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000013   SymDaemon.949
13:02:41.236763  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000090.tok                                                                                                                 0.000062   SymDaemon.949
13:02:41.236795  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000090.tok                                                                                                                 0.000026   SymDaemon.949
13:02:51.280318  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data                                                                                  0.000025   SymDaemon.950
13:02:51.283946  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist                                                                              0.000014   SymDaemon.950
13:02:51.286407  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data                                                                                  0.000013   SymDaemon.949
13:02:51.289351  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data                                                                                  0.000013   SymDaemon.949
13:02:51.289862  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000091.tok                                                                                                                 0.000062   SymDaemon.949
13:02:51.289908  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000091.tok                                                                                                                 0.000038   SymDaemon.949
13:02:51.305457  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist                                                                              0.000015   SymDaemon.949
13:02:51.308111  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist                                                                              0.000013   SymDaemon.949
13:02:51.308374  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000092.tok                                                                                                                 0.000053   SymDaemon.949
13:02:51.308406  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000092.tok                                                                                                                 0.000025   SymDaemon.949
13:03:05.473887  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000024   SymDaemon.950
13:03:05.475173  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.950
13:03:05.477793  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:03:05.478664  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:03:05.478874  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000093.tok                                                                                                                 0.000073   SymDaemon.949
13:03:05.478908  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000093.tok                                                                                                                 0.000026   SymDaemon.949
13:03:05.481241  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000012   SymDaemon.949
13:03:05.483928  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.949
13:03:05.484168  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000094.tok                                                                                                                 0.000046   SymDaemon.949
13:03:05.484199  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000094.tok                                                                                                                 0.000024   SymDaemon.949
13:03:06.547550  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000024   SymDaemon.950
13:03:06.548448  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000013   SymDaemon.949
13:03:06.549029  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000012   SymDaemon.949
13:03:06.549236  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000095.tok                                                                                                                 0.000061   SymDaemon.949
13:03:06.549270  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000095.tok                                                                                                                 0.000026   SymDaemon.949
13:03:12.057672  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist                                                                                             0.000025   SymDaemon.950
13:03:12.058693  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist                                                                                             0.000013   SymDaemon.949
13:03:12.059341  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist                                                                                             0.000012   SymDaemon.949
13:03:12.059637  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000096.tok                                                                                                                 0.000063   SymDaemon.949
13:03:12.059671  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000096.tok                                                                                                                 0.000026   SymDaemon.949
13:03:30.193070  open              F=21       (R_____)  /private/var/db/locationd/clients.plist                                                                                                                               0.000030   SymDaemon.950
13:03:30.194220  open              F=21       (R_____)  /private/var/db/locationd/clients.plist                                                                                                                               0.000013   SymDaemon.949
13:03:30.194805  open              F=21       (R_____)  /private/var/db/locationd/clients.plist                                                                                                                               0.000012   SymDaemon.949
13:03:30.195009  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000097.tok                                                                                                                 0.000068   SymDaemon.949
13:03:30.195043  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000097.tok                                                                                                                 0.000027   SymDaemon.949
13:03:32.795182  open              F=21       (R_____)  /Applications/Safari.app                                                                                                                                              0.000023   SymDaemon.8195
13:03:32.795282  open              F=21       (R_____)  /Applications/Safari.app/Contents                                                                                                                                     0.000020   SymDaemon.8195
13:03:32.795390  open              F=21       (R_____)  /Applications/Safari.app/Contents/Info.plist                                                                                                                          0.000026   SymDaemon.8195
13:03:32.795903  open              F=21       (R_____)  /Applications/Safari.app/Contents/PkgInfo                                                                                                                             0.000039   SymDaemon.8195
13:03:33.937837  open              F=21       (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework                                                                                                            0.000010   SymDaemon.8195
13:03:33.937960  open              F=21       (R_____)  A/Resources                                                                                                                                                           0.000016   SymDaemon.8195
13:03:33.938056  open              F=21       (R_____)  A/Resources/Info.plist                                                                                                                                                0.000027   SymDaemon.8195
13:03:33.938489  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/Contents>>>>>>>>>>>>>>>>>>>>>                                                                              0.000015   SymDaemon.8195
13:03:33.938511  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support Files>>>>>>>>>>>>>>>>                                                                              0.000012   SymDaemon.8195
13:03:33.938531  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/PkgInfo                                                                                                    0.000012   SymDaemon.8195
13:03:35.746456  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000026   SymDaemon.950
13:03:35.748028  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000014   SymDaemon.950
13:03:35.750901  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000025   SymDaemon.950
13:03:35.751844  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.950
13:03:35.752813  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:03:35.753820  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:03:35.754242  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000098.tok                                                                                                                 0.000065   SymDaemon.949
13:03:35.754277  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000098.tok                                                                                                                 0.000026   SymDaemon.949
13:03:35.757266  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.949
13:03:35.760008  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.949
13:03:35.760275  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000099.tok                                                                                                                 0.000050   SymDaemon.949
13:03:35.760307  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000099.tok                                                                                                                 0.000025   SymDaemon.949
13:03:35.760954  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000013   SymDaemon.949
13:03:35.761856  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000012   SymDaemon.949
13:03:35.762240  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009A.tok                                                                                                                 0.000040   SymDaemon.949
13:03:35.762270  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009A.tok                                                                                                                 0.000024   SymDaemon.949
13:03:35.766091  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.949
13:03:35.767116  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000012   SymDaemon.949
13:03:35.767614  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009B.tok                                                                                                                 0.000056   SymDaemon.949
13:03:35.767645  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009B.tok                                                                                                                 0.000024   SymDaemon.949
13:03:36.772356  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000020   SymDaemon.950
13:03:36.773550  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000013   SymDaemon.949
13:03:36.774185  open              F=21       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000014   SymDaemon.949
13:03:36.774466  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009C.tok                                                                                                                 0.000073   SymDaemon.949
13:03:36.774504  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009C.tok                                                                                                                 0.000029   SymDaemon.949
13:03:40.309272  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data                                                                                    0.000025   SymDaemon.950
13:03:40.311591  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist                                                                                0.000014   SymDaemon.950
13:03:40.332034  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data                                                                                    0.000018   SymDaemon.949
13:03:40.332930  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data                                                                                    0.000013   SymDaemon.949
13:03:40.333223  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009D.tok                                                                                                                 0.000062   SymDaemon.949
13:03:40.333256  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009D.tok                                                                                                                 0.000026   SymDaemon.949
13:03:40.334365  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist                                                                                0.000013   SymDaemon.949
13:03:40.341578  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist                                                                                0.000016   SymDaemon.949
13:03:40.341878  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009E.tok                                                                                                                 0.000057   SymDaemon.949
13:03:40.341925  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009E.tok                                                                                                                 0.000026   SymDaemon.949
13:03:40.841251  open              F=21       (R_____)  /Applications/iTunes.app                                                                                                                                              0.000022   SymDaemon.8195
13:03:40.841364  open              F=21       (R_____)  /Applications/iTunes.app/Contents                                                                                                                                     0.000020   SymDaemon.8195
13:03:40.841468  open              F=21       (R_____)  /Applications/iTunes.app/Contents/Info.plist                                                                                                                          0.000026   SymDaemon.8195
13:03:40.842240  open              F=21       (R_____)  /Applications/iTunes.app/Contents/PkgInfo                                                                                                                             0.000024   SymDaemon.8195
13:03:42.216811  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000015   SymDaemon.950
13:03:42.222765  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000013   SymDaemon.949
13:03:42.229259  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000014   SymDaemon.949
13:03:44.389992  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000212 W SymDaemon.950
13:03:44.392944  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000014   SymDaemon.950
13:03:44.395188  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data                                                                                    0.000015   SymDaemon.950
13:03:44.395885  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist                                                                                0.000013   SymDaemon.950
13:03:44.396224  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000013   SymDaemon.949
13:03:44.397107  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000013   SymDaemon.949
13:03:44.397527  open              F=23       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009F.tok                                                                                                                 0.000061   SymDaemon.949
13:03:44.397561  open              F=23       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009F.tok                                                                                                                 0.000027   SymDaemon.949
13:03:44.427401  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000015   SymDaemon.949
13:03:44.428513  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.949
13:03:44.429012  open              F=23       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A0.tok                                                                                                                 0.000052   SymDaemon.949
13:03:44.429044  open              F=23       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A0.tok                                                                                                                 0.000025   SymDaemon.949
13:03:44.447497  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000016   SymDaemon.950
13:03:44.460196  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data                                                                                    0.000016   SymDaemon.949
13:03:44.461007  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data                                                                                    0.000013   SymDaemon.949
13:03:44.461170  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A1.tok                                                                                                                 0.000048   SymDaemon.949
13:03:44.461202  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A1.tok                                                                                                                 0.000025   SymDaemon.949
13:03:44.491527  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist                                                                                0.000015   SymDaemon.949
13:03:44.573513  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist                                                                                0.000016   SymDaemon.949
13:03:44.573775  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A2.tok                                                                                                                 0.000058   SymDaemon.949
13:03:44.573809  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A2.tok                                                                                                                 0.000026   SymDaemon.949
13:03:44.574809  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:44.575883  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:44.576252  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A3.tok                                                                                                                 0.000042   SymDaemon.949
13:03:44.576283  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A3.tok                                                                                                                 0.000025   SymDaemon.949
13:03:45.729595  open              F=21       (R_____)  /Users/admin/Library/Safari/TopSites.plist                                                                                                                            0.000018   SymDaemon.950
13:03:45.730511  open              F=21       (R_____)  /Users/admin/Library/Safari/LastSession.plist                                                                                                                         0.000013   SymDaemon.950
13:03:45.731245  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.950
13:03:45.731984  open              F=21       (R_____)  /Users/admin/Library/Safari/TopSites.plist                                                                                                                            0.000012   SymDaemon.949
13:03:45.732597  open              F=21       (R_____)  /Users/admin/Library/Safari/TopSites.plist                                                                                                                            0.000012   SymDaemon.949
13:03:45.732782  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A4.tok                                                                                                                 0.000059   SymDaemon.949
13:03:45.732815  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A4.tok                                                                                                                 0.000026   SymDaemon.949
13:03:45.733356  open              F=21       (R_____)  /Users/admin/Library/Safari/LastSession.plist                                                                                                                         0.000012   SymDaemon.949
13:03:45.733971  open              F=21       (R_____)  /Users/admin/Library/Safari/LastSession.plist                                                                                                                         0.000012   SymDaemon.949
13:03:45.734131  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A5.tok                                                                                                                 0.000039   SymDaemon.949
13:03:45.734162  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A5.tok                                                                                                                 0.000024   SymDaemon.949
13:03:45.734750  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000012   SymDaemon.949
13:03:45.735441  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000012   SymDaemon.949
13:03:45.735583  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A6.tok                                                                                                                 0.000039   SymDaemon.949
13:03:45.735613  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A6.tok                                                                                                                 0.000024   SymDaemon.949
13:03:46.029306  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000024   SymDaemon.950
13:03:46.030559  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:46.031369  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:46.031816  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A7.tok                                                                                                                 0.000065   SymDaemon.949
13:03:46.031864  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A7.tok                                                                                                                 0.000027   SymDaemon.949
13:03:47.777930  open              F=21       (R_____)  /Applications/App Store.app                                                                                                                                           0.000025   SymDaemon.8195
13:03:47.778055  open              F=21       (R_____)  /Applications/App Store.app/Contents                                                                                                                                  0.000021   SymDaemon.8195
13:03:47.778160  open              F=21       (R_____)  /Applications/App Store.app/Contents/Info.plist                                                                                                                       0.000026   SymDaemon.8195
13:03:47.778335  open              F=21       (R_____)  /Applications/App Store.app/Contents/PkgInfo                                                                                                                          0.000023   SymDaemon.8195
13:03:48.855144  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000015   SymDaemon.950
13:03:48.856201  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000014   SymDaemon.950
13:03:48.857009  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000012   SymDaemon.950
13:03:48.857642  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.950
13:03:48.858358  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000012   SymDaemon.949
13:03:48.858994  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000012   SymDaemon.949
13:03:48.859262  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A8.tok                                                                                                                 0.000076   SymDaemon.949
13:03:48.859300  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A8.tok                                                                                                                 0.000029   SymDaemon.949
13:03:48.875228  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000015   SymDaemon.949
13:03:48.876250  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000012   SymDaemon.949
13:03:48.876423  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A9.tok                                                                                                                 0.000049   SymDaemon.949
13:03:48.876455  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A9.tok                                                                                                                 0.000025   SymDaemon.949
13:03:48.990642  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000017   SymDaemon.949
13:03:48.992131  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000021   SymDaemon.949
13:03:48.992491  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AA.tok                                                                                                                 0.000159   SymDaemon.949
13:03:48.992531  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AA.tok                                                                                                                 0.000031   SymDaemon.949
13:03:48.993716  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000018   SymDaemon.949
13:03:49.014390  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db                                              0.000026   SymDaemon.950
13:03:49.018088  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db                                           0.000013   SymDaemon.950
13:03:49.019323  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000014   SymDaemon.950
13:03:49.020241  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000012   SymDaemon.950
13:03:49.021168  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db                                                                          0.000014   SymDaemon.950
13:03:49.022086  open              F=22       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db                                                                       0.000013   SymDaemon.950
13:03:49.105892  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.949
13:03:49.106098  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AB.tok                                                                                                                 0.000051   SymDaemon.949
13:03:49.106131  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AB.tok                                                                                                                 0.000026   SymDaemon.949
13:03:49.107452  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db                                              0.000151 W SymDaemon.949
13:03:49.108899  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db                                              0.000014   SymDaemon.949
13:03:49.109316  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AC.tok                                                                                                                 0.000048   SymDaemon.949
13:03:49.109349  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AC.tok                                                                                                                 0.000025   SymDaemon.949
13:03:49.261103  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db                                           0.000014   SymDaemon.949
13:03:49.262318  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db                                           0.000014   SymDaemon.949
13:03:49.262840  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AD.tok                                                                                                                 0.000070   SymDaemon.949
13:03:49.262874  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AD.tok                                                                                                                 0.000027   SymDaemon.949
13:03:49.318982  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000017   SymDaemon.949
13:03:49.320177  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000013   SymDaemon.949
13:03:49.320595  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AE.tok                                                                                                                 0.000054   SymDaemon.949
13:03:49.320627  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AE.tok                                                                                                                 0.000025   SymDaemon.949
13:03:49.469812  open              F=22       (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions                                                                                                      0.000011   SymDaemon.8196
13:03:49.469954  open              F=22       (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions                                                                                                      0.000010   SymDaemon.8196
13:03:49.470041  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Contents>>>>>>>>>>>>>>>                                                                              0.000009   SymDaemon.8196
13:03:49.470059  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Support Files>>>>>>>>>>                                                                              0.000008   SymDaemon.8196
13:03:49.470074  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/PkgInfo                                                                                              0.000007   SymDaemon.8196
13:03:49.498642  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000016   SymDaemon.949
13:03:49.499790  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.949
13:03:49.500309  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AF.tok                                                                                                                 0.000053   SymDaemon.949
13:03:49.500341  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AF.tok                                                                                                                 0.000025   SymDaemon.949
13:03:49.505639  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db                                                                          0.000017   SymDaemon.949
13:03:49.507048  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db                                                                          0.000017   SymDaemon.949
13:03:49.507494  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B0.tok                                                                                                                 0.000066   SymDaemon.949
13:03:49.507528  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B0.tok                                                                                                                 0.000027   SymDaemon.949
13:03:49.509300  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db                                                                       0.000014   SymDaemon.949
13:03:49.510396  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db                                                                       0.000013   SymDaemon.949
13:03:49.510891  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B1.tok                                                                                                                 0.000045   SymDaemon.949
13:03:49.510923  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B1.tok                                                                                                                 0.000024   SymDaemon.949
13:03:49.530932  open              F=21       (R_____)  /System/Library/CoreServices/ManagedClient.app                                                                                                                        0.000010   SymDaemon.8195
13:03:49.531013  open              F=21       (R_____)  /System/Library/CoreServices/ManagedClient.app/Contents                                                                                                               0.000011   SymDaemon.8195
13:03:49.531102  open              F=21       (R_____)  /System/Library/CoreServices/ManagedClient.app/Contents/Info.plist                                                                                                    0.000022   SymDaemon.8195
13:03:49.531224  open              F=21       (R_____)  /System/Library/CoreServices/ManagedClient.app/Contents/PkgInfo                                                                                                       0.000023   SymDaemon.8195
13:03:50.949531  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000022   SymDaemon.950
13:03:50.952195  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000029   SymDaemon.949
13:03:50.953736  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000022   SymDaemon.949
13:03:50.954603  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B2.tok                                                                                                                 0.000074   SymDaemon.949
13:03:50.954640  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B2.tok                                                                                                                 0.000028   SymDaemon.949
13:03:51.013404  open              F=23       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000027   SymDaemon.950
13:03:51.014626  open              F=23       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.950
13:03:51.015468  open              F=23       (R_____)  /Users/admin/Library/Caches/com.apple.storeagent/updates.plist                                                                                                        0.000014   SymDaemon.950
13:03:51.016121  open              F=23       (R_____)  /Users/admin/Library/Cookies/com.apple.appstore.cookies                                                                                                               0.000013   SymDaemon.950
13:03:51.016751  open              F=23       (R_____)  /Library/Application Support/App Store/adoption.plist                                                                                                                 0.000013   SymDaemon.950
13:03:51.017400  open              F=23       (R_____)  /private/var/db/launchd.db/com.apple.launchd/overrides.plist                                                                                                          0.000013   SymDaemon.950
13:03:51.018014  open              F=23       (R_____)  /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist                                                                                       0.000025   SymDaemon.950
13:03:51.019227  open              F=23       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist                                                                         0.000014   SymDaemon.950
13:03:51.047127  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist                                                                         0.000017   SymDaemon.950
13:03:51.048112  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist                                                                       0.000013   SymDaemon.950
13:03:51.048859  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.nsservicescache.plist                                                                                                           0.000013   SymDaemon.950
13:03:51.050043  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000013   SymDaemon.949
13:03:51.050852  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.949
13:03:51.051252  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B3.tok                                                                                                                 0.000054   SymDaemon.949
13:03:51.051284  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B3.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.074181  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.949
13:03:51.075109  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000012   SymDaemon.949
13:03:51.075291  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B4.tok                                                                                                                 0.000045   SymDaemon.949
13:03:51.075323  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B4.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.094970  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.storeagent/updates.plist                                                                                                        0.000016   SymDaemon.949
13:03:51.095786  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.storeagent/updates.plist                                                                                                        0.000013   SymDaemon.949
13:03:51.095970  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B5.tok                                                                                                                 0.000052   SymDaemon.949
13:03:51.096002  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B5.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.127147  open              F=21       (R_____)  /Users/admin/Library/Cookies/com.apple.appstore.cookies                                                                                                               0.000016   SymDaemon.949
13:03:51.127955  open              F=21       (R_____)  /Users/admin/Library/Cookies/com.apple.appstore.cookies                                                                                                               0.000012   SymDaemon.949
13:03:51.128160  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B6.tok                                                                                                                 0.000053   SymDaemon.949
13:03:51.128192  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B6.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.145362  open              F=21       (R_____)  /Library/Application Support/App Store/adoption.plist                                                                                                                 0.000014   SymDaemon.949
13:03:51.146177  open              F=21       (R_____)  /Library/Application Support/App Store/adoption.plist                                                                                                                 0.000012   SymDaemon.949
13:03:51.146259  open              F=22       (R_____)  /Library/Application Support/App Store/adoption.plist                                                                                                                 0.000012   SymDaemon.949
13:03:51.146436  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B7.tok                                                                                                                 0.000050   SymDaemon.949
13:03:51.146467  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B7.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.164358  open              F=21       (R_____)  /private/var/db/launchd.db/com.apple.launchd/overrides.plist                                                                                                          0.000016   SymDaemon.949
13:03:51.165194  open              F=21       (R_____)  /private/var/db/launchd.db/com.apple.launchd/overrides.plist                                                                                                          0.000012   SymDaemon.949
13:03:51.165264  open              F=22       (R_____)  /private/var/db/launchd.db/com.apple.launchd/overrides.plist                                                                                                          0.000012   SymDaemon.949
13:03:51.165435  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B8.tok                                                                                                                 0.000052   SymDaemon.949
13:03:51.165466  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B8.tok                                                                                                                 0.000025   SymDaemon.949
13:03:51.179368  open              F=21       (R_____)  /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist                                                                                       0.000026   SymDaemon.949
13:03:51.180143  open              F=21       (R_____)  /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist                                                                                       0.000021   SymDaemon.949
13:03:51.180216  open              F=22       (R_____)  /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist                                                                                       0.000020   SymDaemon.949
13:03:51.180391  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B9.tok                                                                                                                 0.000047   SymDaemon.949
13:03:51.180421  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B9.tok                                                                                                                 0.000024   SymDaemon.949
13:03:51.241986  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist                                                                         0.000014   SymDaemon.949
13:03:51.243114  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist                                                                         0.000012   SymDaemon.949
13:03:51.243706  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BA.tok                                                                                                                 0.000058   SymDaemon.949
13:03:51.243739  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BA.tok                                                                                                                 0.000026   SymDaemon.949
13:03:51.463647  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist                                                                         0.000016   SymDaemon.949
13:03:51.464705  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist                                                                         0.000013   SymDaemon.949
13:03:51.464935  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BB.tok                                                                                                                 0.000053   SymDaemon.949
13:03:51.465020  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BB.tok                                                                                                                 0.000079   SymDaemon.949
13:03:51.468332  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist                                                                       0.000014   SymDaemon.949
13:03:51.469153  open              F=21       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist                                                                       0.000013   SymDaemon.949
13:03:51.469393  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BC.tok                                                                                                                 0.000044   SymDaemon.949
13:03:51.469423  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BC.tok                                                                                                                 0.000024   SymDaemon.949
13:03:51.474846  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.nsservicescache.plist                                                                                                           0.000013   SymDaemon.949
13:03:51.477227  open              F=21       (R_____)  /Users/admin/Library/Caches/com.apple.nsservicescache.plist                                                                                                           0.000018   SymDaemon.949
13:03:51.477536  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BD.tok                                                                                                                 0.000071   SymDaemon.949
13:03:51.477573  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BD.tok                                                                                                                 0.000029   SymDaemon.949
13:03:53.387589  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library.itl                                                                                                                          0.000025   SymDaemon.950
13:03:53.391003  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Extras.itdb                                                                                                                  0.000014   SymDaemon.950
13:03:53.392889  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000013   SymDaemon.950
13:03:53.393453  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library.itl                                                                                                                          0.000012   SymDaemon.949
13:03:53.397652  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library.itl                                                                                                                          0.000013   SymDaemon.949
13:03:53.398128  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BE.tok                                                                                                                 0.000063   SymDaemon.949
13:03:53.398163  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BE.tok                                                                                                                 0.000027   SymDaemon.949
13:03:53.399048  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Extras.itdb                                                                                                                  0.000012   SymDaemon.949
13:03:53.400789  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Extras.itdb                                                                                                                  0.000012   SymDaemon.949
13:03:53.401775  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BF.tok                                                                                                                 0.000041   SymDaemon.949
13:03:53.401806  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BF.tok                                                                                                                 0.000025   SymDaemon.949
13:03:53.403029  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000012   SymDaemon.949
13:03:53.403542  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000012   SymDaemon.949
13:03:53.403666  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C0.tok                                                                                                                 0.000038   SymDaemon.949
13:03:53.403696  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C0.tok                                                                                                                 0.000024   SymDaemon.949
13:04:00.547142  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000024   SymDaemon.950
13:04:00.548411  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000013   SymDaemon.949
13:04:00.549268  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000012   SymDaemon.949
13:04:00.549465  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C1.tok                                                                                                                 0.000060   SymDaemon.949
13:04:00.549499  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C1.tok                                                                                                                 0.000026   SymDaemon.949
13:04:03.157699  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000025   SymDaemon.950
13:04:03.158584  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000013   SymDaemon.950
13:04:03.159448  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.950
13:04:03.160108  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000013   SymDaemon.950
13:04:03.161050  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.appstore.plist                                                                                                             0.000013   SymDaemon.950
13:04:03.161717  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.storeagent.plist                                                                                                           0.000013   SymDaemon.950
13:04:03.162340  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000012   SymDaemon.949
13:04:03.162976  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000012   SymDaemon.949
13:04:03.163193  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C2.tok                                                                                                                 0.000066   SymDaemon.949
13:04:03.163227  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C2.tok                                                                                                                 0.000026   SymDaemon.949
13:04:03.163702  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000012   SymDaemon.949
13:04:03.164429  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000012   SymDaemon.949
13:04:03.164572  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C3.tok                                                                                                                 0.000039   SymDaemon.949
13:04:03.164603  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C3.tok                                                                                                                 0.000024   SymDaemon.949
13:04:03.173689  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.949
13:04:03.175251  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.949
13:04:03.175413  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C4.tok                                                                                                                 0.000043   SymDaemon.949
13:04:03.175444  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C4.tok                                                                                                                 0.000024   SymDaemon.949
13:04:03.175838  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000012   SymDaemon.949
13:04:03.176725  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000012   SymDaemon.949
13:04:03.176865  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C5.tok                                                                                                                 0.000039   SymDaemon.949
13:04:03.176907  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C5.tok                                                                                                                 0.000036   SymDaemon.949
13:04:03.177854  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.appstore.plist                                                                                                             0.000012   SymDaemon.949
13:04:03.178457  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.appstore.plist                                                                                                             0.000012   SymDaemon.949
13:04:03.178620  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C6.tok                                                                                                                 0.000039   SymDaemon.949
13:04:03.178651  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C6.tok                                                                                                                 0.000024   SymDaemon.949
13:04:03.179437  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.storeagent.plist                                                                                                           0.000012   SymDaemon.949
13:04:03.180003  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.storeagent.plist                                                                                                           0.000012   SymDaemon.949
13:04:03.180137  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C7.tok                                                                                                                 0.000038   SymDaemon.949
13:04:03.180167  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C7.tok                                                                                                                 0.000024   SymDaemon.949
13:04:10.997639  open              F=21       (R_____)  /Users/admin/Desktop/OFF.log                                                                                                                                          0.000024   SymDaemon.950
13:04:10.998761  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db-wal                                                                                                                      0.000014   SymDaemon.950
13:04:10.999343  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db                                                                                                                          0.000013   SymDaemon.950
13:04:11.001468  open              F=21       (R_____)  /Users/admin/Desktop/OFF.log                                                                                                                                          0.000012   SymDaemon.949
13:04:11.002370  open              F=21       (R_____)  /Users/admin/Desktop/OFF.log                                                                                                                                          0.000012   SymDaemon.949
13:04:11.002449  open              F=22       (R_____)  /Users/admin/Desktop/OFF.log                                                                                                                                          0.000012   SymDaemon.949
13:04:11.002655  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C8.tok                                                                                                                 0.000068   SymDaemon.949
13:04:11.002688  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C8.tok                                                                                                                 0.000026   SymDaemon.949
13:04:11.045240  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db-wal                                                                                                                      0.000014   SymDaemon.949
13:04:11.045786  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db-wal                                                                                                                      0.000012   SymDaemon.949
13:04:11.045946  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db                                                                                                                          0.000012   SymDaemon.949
13:04:11.049096  open              F=21       (R_____)  /Users/admin/Library/IdentityServices/ids.db                                                                                                                          0.000012   SymDaemon.949
13:04:11.050999  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C9.tok                                                                                                                 0.000051   SymDaemon.949
13:04:11.051031  open              F=22       (RWC_T_)  /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C9.tok                      

以下はアイドル状態の Mac からのログファイルの例で、オープン操作のみを表示するようにフィルタリングされています。圧縮ファイルの自動保護スキャンが無効になっています。

12:59:12.200034  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000026   SymDaemon.950
12:59:13.788970  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data                                                                                  0.000025   SymDaemon.950
12:59:13.791806  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist                                                                              0.000014   SymDaemon.950
12:59:14.866217  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler                                                    0.000028   SymDaemon.950
12:59:20.881158  open              F=20       (R_____)  /private/var/root/Library/Preferences/com.apple.xpc.activity.plist                                                                                                    0.000025   SymDaemon.950
12:59:28.180117  open              F=20       (R_____)  /private/var/db/systemstats/snapshots.db-wal                                                                                                                          0.000026   SymDaemon.950
12:59:28.180971  open              F=20       (R_____)  /private/var/db/systemstats/snapshots.db                                                                                                                              0.000013   SymDaemon.950
12:59:45.493017  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000025   SymDaemon.950
12:59:45.494278  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist                                                                               0.000013   SymDaemon.950
13:00:02.824416  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000028   SymDaemon.950
13:00:12.177829  open              F=20       (R_____)  /Applications/Safari.app                                                                                                                                              0.000030   SymDaemon.7119
13:00:12.180053  open              F=20       (R_____)  /Applications/Safari.app/Contents                                                                                                                                     0.000026   SymDaemon.7119
13:00:12.180168  open              F=20       (R_____)  /Applications/Safari.app/Contents/Info.plist                                                                                                                          0.000028   SymDaemon.7119
13:00:12.180667  open              F=20       (R_____)  /Applications/Safari.app/Contents/PkgInfo                                                                                                                             0.000024   SymDaemon.7119
13:00:12.626987  open              F=20       (R_____)  /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app                                                                                      0.000013   SymDaemon.7119
13:00:12.627083  open              F=20       (R_____)  /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents                                                                             0.000012   SymDaemon.7119
13:00:12.627177  open              F=20       (R_____)  /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/Info.plist                                                                  0.000027   SymDaemon.7119
13:00:12.627332  open              F=20       (R_____)  /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/PkgInfo                                                                     0.000023   SymDaemon.7119
13:00:13.085954  open              F=20       (R_____)  A/Frameworks/LaunchServices.framework                                                                                                                                 0.000018   SymDaemon.7119
13:00:13.086077  open              F=20       (R_____)  A/Resources                                                                                                                                                           0.000018   SymDaemon.7119
13:00:13.086376  open              F=20       (R_____)  A/Resources/Info.plist                                                                                                                                                0.000052   SymDaemon.7119
13:00:13.089136  open                   [  2] (R_____)  A/Frameworks/LaunchServices.framework/Contents>>>>>>>>>>                                                                                                              0.000013   SymDaemon.7119
13:00:13.089158  open                   [  2] (R_____)  A/Frameworks/LaunchServices.framework/Support Files>>>>>                                                                                                              0.000011   SymDaemon.7119
13:00:13.089177  open                   [  2] (R_____)  A/Frameworks/LaunchServices.framework/PkgInfo                                                                                                                         0.000010   SymDaemon.7119
13:00:13.089346  open              F=20       (R_____)  /System                                                                                                                                                               0.000020   SymDaemon.7119
13:00:13.089476  open              F=20       (R_____)  /System                                                                                                                                                               0.000009   SymDaemon.7119
13:00:13.089543  open                   [  2] (R_____)  /System/Contents>>>>>>>>                                                                                                                                              0.000007   SymDaemon.7119
13:00:13.089558  open                   [  2] (R_____)  /System/Support Files>>>                                                                                                                                              0.000007   SymDaemon.7119
13:00:13.089571  open                   [  2] (R_____)  /System/PkgInfo                                                                                                                                                       0.000006   SymDaemon.7119
13:00:13.273182  open              F=20       (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework                                                                                                            0.000011   SymDaemon.7119
13:00:13.289982  open              F=20       (R_____)  A/Resources                                                                                                                                                           0.000017   SymDaemon.7119
13:00:13.290069  open              F=20       (R_____)  A/Resources/Info.plist                                                                                                                                                0.000027   SymDaemon.7119
13:00:13.290508  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/Contents>>>>>>>>>>>>>>>>>>>>>                                                                              0.000009   SymDaemon.7119
13:00:13.290525  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support Files>>>>>>>>>>>>>>>>                                                                              0.000008   SymDaemon.7119
13:00:13.290540  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/SyncedDefaults.framework/PkgInfo                                                                                                    0.000007   SymDaemon.7119
13:00:14.012005  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000022   SymDaemon.950
13:00:14.013483  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.PubSubAgent.plist                                                                                                          0.000013   SymDaemon.950
13:00:14.014209  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000013   SymDaemon.950
13:00:15.048007  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore                                                                      0.000016   SymDaemon.950
13:00:15.049234  open              F=20       (R_____)  /Users/admin/Library/SyncedPreferences/com.apple.syncedpreferences.plist                                                                                              0.000014   SymDaemon.950
13:00:15.050043  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.Safari/com.apple.sandbox/sandbox-cache.db                              0.000014   SymDaemon.950
13:00:15.051103  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.IconServices/6100D2A3FF19F8B18C1B86F91DBC3BC5.iscachebmp                                           0.000013   SymDaemon.950
13:00:16.050942  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.Networking+com.apple.Safari/com.apple.sandbox/sandbox-cache.db                              0.000022   SymDaemon.950
13:00:17.140451  open              F=20       (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions                                                                                                               0.000015   SymDaemon.7119
13:00:17.157535  open              F=20       (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions                                                                                                               0.000013   SymDaemon.7119
13:00:17.160556  open                   [  2] (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions/Contents>>>>>>>>>>>>>>>>>>>>>>>>                                                                              0.000011   SymDaemon.7119
13:00:17.160573  open                   [  2] (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions/Support Files>>>>>>>>>>>>>>>>>>>                                                                              0.000007   SymDaemon.7119
13:00:17.160597  open                   [  2] (R_____)  /System/Library/Frameworks/CFNetwork.framework/Versions/PkgInfo                                                                                                       0.000016   SymDaemon.7119
13:00:17.218248  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000031   SymDaemon.950
13:00:17.219648  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000013   SymDaemon.950
13:00:17.220892  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000013   SymDaemon.950
13:00:19.005893  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000024   SymDaemon.950
13:00:19.011780  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000016   SymDaemon.950
13:00:19.012747  open              F=20       (R_____)  /Users/admin/Library/Preferences/.GlobalPreferences.plist                                                                                                             0.000013   SymDaemon.950
13:00:19.013460  open              F=20       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.950
13:00:19.014525  open              F=20       (R_____)  /Users/admin/Library/Safari/Configurations.plist.signed                                                                                                               0.000013   SymDaemon.950
13:00:19.015608  open              F=20       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000029   SymDaemon.950
13:00:19.077770  open              F=20       (R_____)  /Users/admin/Library/PubSub/Clients.plist                                                                                                                             0.000013   SymDaemon.950
13:00:19.802168  open              F=20       (R_____)  /Applications/Safari.app                                                                                                                                              0.000024   SymDaemon.7149
13:00:19.802274  open              F=20       (R_____)  /Applications/Safari.app/Contents                                                                                                                                     0.000020   SymDaemon.7149
13:00:19.802384  open              F=20       (R_____)  /Applications/Safari.app/Contents/Info.plist                                                                                                                          0.000028   SymDaemon.7149
13:00:19.802887  open              F=20       (R_____)  /Applications/Safari.app/Contents/PkgInfo                                                                                                                             0.000023   SymDaemon.7149
13:00:21.769278  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.help.plist                                                                                                                 0.000029   SymDaemon.950
13:00:21.770498  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000013   SymDaemon.950
13:00:21.771249  open              F=20       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist                                                                                           0.000014   SymDaemon.950
13:00:21.773267  open              F=20       (R_____)  /Users/admin/Library/Preferences/QuickTime Preferences                                                                                                                0.000014   SymDaemon.950
13:00:21.774499  open              F=20       (R_____)  /Users/admin/Library/Preferences/com.apple.quicktime.plugin.preferences.plist                                                                                         0.000014   SymDaemon.950
13:00:21.775551  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/77C0C2D0-E042-437A-9100-D27CA7FD2425.webbookmark                                                                0.000013   SymDaemon.950
13:00:21.777461  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/C6031387-61B7-49B1-8A9A-D7C6C87DE78D.webbookmark                                                                0.000015   SymDaemon.950
13:00:21.778163  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/83EEF489-E547-42F6-863B-354E93A680A2.webbookmark                                                                0.000013   SymDaemon.950
13:00:21.778786  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/47035D3E-FDF5-48F1-B517-F0A00E521C07.webbookmark                                                                0.000014   SymDaemon.950
13:00:22.181192  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/B4B283AB-C684-47CA-9B1F-8C4F06B21572.webbookmark                                                                0.000017   SymDaemon.950
13:00:22.182105  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/6B057C96-609F-4B63-8E37-14FA085A1C4C.webbookmark                                                                0.000014   SymDaemon.950
13:00:22.182768  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/3FCC16BB-E56A-4DB5-8941-33170A67B99F.webbookmark                                                                0.000014   SymDaemon.950
13:00:22.183478  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/402ADB1C-C3C0-4CD1-8158-B45C4D8E438C.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.184158  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/CCDEA395-8D07-4670-8308-1471D7793EB1.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.184815  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/E5DDF305-0348-4C54-8D36-B165C79984D8.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.186045  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/3CDDF82B-8590-4963-9D41-066DB0574505.webbookmark                                                                0.000014   SymDaemon.950
13:00:22.186705  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/62A98F7F-5C73-497C-AC5A-B48FE618D404.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.187574  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/DA234375-1282-4BC8-81D8-25EA4B638E69.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.188271  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/9B6374E2-DA43-4F4C-BDA0-BF382E17521F.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.188939  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/6D51CBD4-03FA-4370-AD96-CF956F2D17BF.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.189558  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/C3248BD4-C35F-48F4-B58F-A6D6EE78BE1E.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.190367  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/78C8B380-4513-455B-B6DF-AD0B83043243.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.191011  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/2817963C-D664-42D1-89C5-B8C8912CADCB.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.191652  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/96441F34-A8FD-46D9-A524-7050100186A0.webbookmark                                                                0.000013   SymDaemon.950
13:00:22.201184  open              F=20       (R_____)  /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/93915673-0C21-4AC6-A67B-7F9D4B9A5559.webbookmark                                                                0.000015   SymDaemon.950
13:00:22.201955  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data                                                                                    0.000013   SymDaemon.950
13:00:22.202907  open              F=20       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist                                                                                0.000013   SymDaemon.950
13:00:22.361589  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache                                                                                     0.000018   SymDaemon.950
13:00:23.187710  open              F=20       (R_____)  /System                                                                                                                                                               0.000026   SymDaemon.7119
13:00:23.187866  open              F=20       (R_____)  /System                                                                                                                                                               0.000009   SymDaemon.7119
13:00:23.187953  open                   [  2] (R_____)  /System/Contents>>>>>>>>                                                                                                                                              0.000008   SymDaemon.7119
13:00:23.187971  open                   [  2] (R_____)  /System/Support Files>>>                                                                                                                                              0.000007   SymDaemon.7119
13:00:23.187985  open                   [  2] (R_____)  /System/PkgInfo                                                                                                                                                       0.000007   SymDaemon.7119
13:00:25.062208  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/75B9C4C4-FA40-4489-ABEA-FFB4221D1F8E                                                                        0.000027   SymDaemon.950
13:00:25.063510  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore                                                                      0.000014   SymDaemon.950
13:00:25.064300  open              F=20       (R_____)  /Users/admin/Library/Safari/TopSites.plist                                                                                                                            0.000013   SymDaemon.950
13:00:25.065020  open              F=20       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/index.sqlite                                                              0.000014   SymDaemon.950
13:00:27.514080  open              F=20       (R_____)  /Users/admin/Library/Safari/WebpageIcons.db                                                                                                                           0.000028   SymDaemon.950
13:00:27.516109  open              F=20       (R_____)  /Users/admin/Library/Safari/LastSession.plist                                                                                                                         0.000014   SymDaemon.950
13:00:27.516849  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/580F555A-AD45-424B-9320-D743D877F596                                                                        0.000014   SymDaemon.950
13:00:27.517500  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/0A9C8198-8A19-43AD-A8FD-C598DCC46470                                                                        0.000013   SymDaemon.950
13:00:27.518067  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/FDBB7D0E-E4BC-4A29-97D7-9614754CE29C                                                                        0.000014   SymDaemon.950
13:00:27.518634  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/A66DFC9E-8067-49CA-889B-6C16C500DCD7                                                                        0.000013   SymDaemon.950
13:00:27.519947  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/21417647-DC56-4651-ADD2-C7024403FDCF                                                                        0.000014   SymDaemon.950
13:00:27.521247  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/2DE01F36-F367-4FBA-9804-A3AFC0B69A77                                                                        0.000013   SymDaemon.950
13:00:28.072682  open              F=20       (R_____)  /Applications/iTunes.app                                                                                                                                              0.000034   SymDaemon.7119
13:00:28.072798  open              F=20       (R_____)  /Applications/iTunes.app/Contents                                                                                                                                     0.000021   SymDaemon.7119
13:00:28.072908  open              F=20       (R_____)  /Applications/iTunes.app/Contents/Info.plist                                                                                                                          0.000028   SymDaemon.7119
13:00:28.073588  open              F=20       (R_____)  /Applications/iTunes.app/Contents/PkgInfo                                                                                                                             0.000024   SymDaemon.7119
13:00:28.074136  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/569AB7AC-CB4B-40A5-8F6F-C25F35360D23                                                                        0.000014   SymDaemon.950
13:00:28.075656  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/4A448E90-0FAD-40F9-9D9E-05C69D2522EE                                                                        0.000014   SymDaemon.950
13:00:28.076330  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/436642F8-8345-4886-9183-EE2986D0E2EA                                                                        0.000013   SymDaemon.950
13:00:28.077520  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/09EB8C21-D2E6-4B1A-9A33-03999679763B                                                                        0.000013   SymDaemon.950
13:00:28.078199  open              F=20       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist                                                                         0.000013   SymDaemon.950
13:00:28.079107  open              F=20       (R_____)  /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist                                                                         0.000013   SymDaemon.950
13:00:28.079958  open              F=20       (R_____)  /Users/admin/Library/Caches/com.apple.nsservicescache.plist                                                                                                           0.000013   SymDaemon.950
13:00:28.080919  open              F=20       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.950
13:00:30.134883  open              F=20       (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions                                                                                                      0.000016   SymDaemon.7119
13:00:30.135032  open              F=20       (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions                                                                                                      0.000010   SymDaemon.7119
13:00:30.135106  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Contents>>>>>>>>>>>>>>>                                                                              0.000009   SymDaemon.7119
13:00:30.135124  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Support Files>>>>>>>>>>                                                                              0.000007   SymDaemon.7119
13:00:30.135139  open                   [  2] (R_____)  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/PkgInfo                                                                                              0.000008   SymDaemon.7119
13:00:30.135477  open              F=20       (R_____)  /Users/admin/Library/Caches/QCCompositionRepository-com.apple.iTunes.cache                                                                                            0.000014   SymDaemon.950
13:00:30.136715  open              F=20       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000013   SymDaemon.950
13:00:30.138054  open              F=20       (R_____)  /Users/admin/Music/iTunes/iTunes Library Genius.itdb                                                                                                                  0.000012   SymDaemon.950
13:00:30.168215  open              F=20       (R_____)  private/var/log/system.log                                                                                                                                            0.000022   SymDaemon.7149
13:00:31.008865  open              F=21       (R_____)  /Users/admin/Library/Containers/com.apple.BKAgentService/Container.plist                                                                                              0.000015   SymDaemon.950
13:00:31.010139  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000012   SymDaemon.950
13:00:32.789758  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.sandbox/sandbox-cache.db                                                                           0.000019   SymDaemon.950
13:00:32.805909  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/.iTunes Preferences.plist                                                                                                      0.000016   SymDaemon.950
13:00:32.808049  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ar.strings                                                                    0.000031   SymDaemon.950
13:00:32.808772  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ca.strings                                                                    0.000028   SymDaemon.950
13:00:32.809719  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/cs.strings                                                                    0.000029   SymDaemon.950
13:00:32.810409  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/da.strings                                                                    0.000028   SymDaemon.950
13:00:32.811159  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Dutch.strings                                                                 0.000029   SymDaemon.950
13:00:32.811843  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/el.strings                                                                    0.000042   SymDaemon.950
13:00:32.812505  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/en_GB.strings                                                                 0.000028   SymDaemon.950
13:00:32.813186  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/English.strings                                                               0.000028   SymDaemon.950
13:00:32.813833  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/fi.strings                                                                    0.000039   SymDaemon.950
13:00:32.814507  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/French.strings                                                                0.000028   SymDaemon.950
13:00:32.815374  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/German.strings                                                                0.000028   SymDaemon.950
13:00:32.816054  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/he.strings                                                                    0.000029   SymDaemon.950
13:00:32.816753  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/hr.strings                                                                    0.000028   SymDaemon.950
13:00:32.817638  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/hu.strings                                                                    0.000028   SymDaemon.950
13:00:32.818330  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/id.strings                                                                    0.000029   SymDaemon.950
13:00:32.820483  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Italian.strings                                                               0.000031   SymDaemon.950
13:00:32.821200  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Japanese.strings                                                              0.000029   SymDaemon.950
13:00:32.821889  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ko.strings                                                                    0.000028   SymDaemon.950
13:00:32.822581  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ms.strings                                                                    0.000027   SymDaemon.950
13:00:32.823278  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/no.strings                                                                    0.000029   SymDaemon.950
13:00:32.823948  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pl.strings                                                                    0.000028   SymDaemon.950
13:00:32.824654  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pt.strings                                                                    0.000027   SymDaemon.950
13:00:32.825612  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pt_PT.strings                                                                 0.000031   SymDaemon.950
13:00:32.826292  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ro.strings                                                                    0.000028   SymDaemon.950
13:00:32.826983  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ru.strings                                                                    0.000028   SymDaemon.950
13:00:32.827654  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/sk.strings                                                                    0.000027   SymDaemon.950
13:00:32.828318  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Spanish.strings                                                               0.000029   SymDaemon.950
13:00:32.828999  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/sv.strings                                                                    0.000028   SymDaemon.950
13:00:32.829660  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/th.strings                                                                    0.000028   SymDaemon.950
13:00:32.830343  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/tr.strings                                                                    0.000028   SymDaemon.950
13:00:32.831095  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/uk.strings                                                                    0.000028   SymDaemon.950
13:00:32.831760  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/vi.strings                                                                    0.000028   SymDaemon.950
13:00:32.832441  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/zh_CN.strings                                                                 0.000028   SymDaemon.950
13:00:32.833108  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/zh_TW.strings                                                                 0.000028   SymDaemon.950
13:00:32.833797  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db                                                                                             0.000014   SymDaemon.950
13:00:32.834776  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db                                                                                          0.000012   SymDaemon.950
13:00:33.171149  open              F=21       (R_____)  /System                                                                                                                                                               0.000026   SymDaemon.7149
13:00:33.171310  open              F=21       (R_____)  /System                                                                                                                                                               0.000009   SymDaemon.7149
13:00:33.171384  open                   [  2] (R_____)  /System/Contents>>>>>>>>                                                                                                                                              0.000007   SymDaemon.7149
13:00:33.171401  open                   [  2] (R_____)  /System/Support Files>>>                                                                                                                                              0.000007   SymDaemon.7149
13:00:33.171415  open                   [  2] (R_____)  /System/PkgInfo                                                                                                                                                       0.000007   SymDaemon.7149
13:00:33.173378  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.Safari.plist                                                                                                               0.000016   SymDaemon.950
13:00:33.174561  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.dock.plist                                                                                                                 0.000013   SymDaemon.950
13:00:33.175599  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000013   SymDaemon.950
13:00:33.176470  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000013   SymDaemon.950
13:00:33.177131  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000014   SymDaemon.950
13:00:33.178044  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist                                                                                           0.000019   SymDaemon.950
13:00:33.179497  open              F=21       (R_____)  /private/var/db/crls/ocspcache.db                                                                                                                                     0.000018   SymDaemon.950
13:00:33.180746  open              F=21       (R_____)  /Users/admin/Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/Books.plist                                                                      0.000014   SymDaemon.950
13:00:33.182208  open              F=21       (R_____)  /Users/admin/Library/Cookies/com.apple.ibooks.cookies                                                                                                                 0.000013   SymDaemon.950
13:00:33.182840  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.bookstoreagent.plist                                                                                                       0.000013   SymDaemon.950
13:00:35.179280  open              F=21       (R_____)  /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore                                                                      0.000017   SymDaemon.950
13:00:35.180362  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library.itl                                                                                                                          0.000013   SymDaemon.950
13:00:35.185564  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.loginitems.plist                                                                                                           0.000015   SymDaemon.950
13:00:35.186232  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Music Library.xml                                                                                                                    0.000013   SymDaemon.950
13:00:35.948335  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000014   SymDaemon.7119
13:00:35.948503  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000012   SymDaemon.7119
13:00:35.948581  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Contents>>>>>>>                                                                                                              0.000012   SymDaemon.7119
13:00:35.948601  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Support Files>>                                                                                                              0.000010   SymDaemon.7119
13:00:35.948625  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/PkgInfo                                                                                                                      0.000016   SymDaemon.7119
13:00:36.265471  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iApps.plist                                                                                                                0.000027   SymDaemon.950
13:00:36.266371  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Extras.itdb                                                                                                                  0.000013   SymDaemon.950
13:00:36.267276  open              F=21       (R_____)  /Users/admin/Music/iTunes/iTunes Library Genius.itdb                                                                                                                  0.000013   SymDaemon.950
13:00:36.268298  open              F=21       (R_____)  /Users/admin/Music/iTunes/sentinel                                                                                                                                    0.000013   SymDaemon.950
13:00:36.268894  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.eq.plist                                                                                                            0.000024   SymDaemon.950
13:00:36.269742  open              F=21       (R_____)  /Users/admin/Library/Cookies/Cookies.binarycookies                                                                                                                    0.000013   SymDaemon.950
13:00:44.647426  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000027   SymDaemon.950
13:00:48.130293  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.iTunes.plist                                                                                                               0.000026   SymDaemon.950
13:00:48.131366  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist                                                                                           0.000013   SymDaemon.950
13:00:48.132192  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.bookstoreagent.plist                                                                                                       0.000013   SymDaemon.950
13:00:48.132858  open              F=21       (R_____)  /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist                                                                                      0.000013   SymDaemon.950
13:00:48.133479  open              F=21       (R_____)  /Users/admin/Library/Preferences/com.apple.spaces.plist                                                                                                               0.000012   SymDaemon.950
13:00:49.012579  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000014   SymDaemon.7119
13:00:49.012727  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000012   SymDaemon.7119
13:00:49.012804  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Contents>>>>>>>                                                                                                              0.000011   SymDaemon.7119
13:00:49.012836  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Support Files>>                                                                                                              0.000022   SymDaemon.7119
13:00:49.012854  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/PkgInfo                                                                                                                      0.000010   SymDaemon.7119
13:00:49.016564  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000013   SymDaemon.7119
13:00:49.016698  open              F=21       (R_____)  A/Frameworks/Metadata.framework/Versions                                                                                                                              0.000012   SymDaemon.7119
13:00:49.016772  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Contents>>>>>>>                                                                                                              0.000011   SymDaemon.7119
13:00:49.016792  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/Support Files>>                                                                                                              0.000010   SymDaemon.7119
13:00:49.016810  open                   [  2] (R_____)  A/Frameworks/Metadata.framework/Versions/PkgInfo                                                                                                                      0.000010   SymDaemon.7119
13:00:58.131598  open              F=21       (R_____)  /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data                                                                                   0.000025   SymDaemon.950 

Additional Information

[英語文書] How to use Macintosh fs_usage command line to trace SEP file activity