Mac の fs_usage コマンドラインを使用してファイルの動作をトレースする
Article ID: 241947
Updated On:
Products
Endpoint Protection
Issue/Introduction
fs_usage コマンドラインを使用して Symantec Endpoint Protection (SEP) ファイルの動作をトレースしたい。
Resolution
Mac のターミナルアプリケーションで以下のコマンドを実行します。
sudo -b fs_usage -w -f pathname SymDaemon > ~/Desktop/symdaemon.log
このコマンドによりバックグラウンドで fs_usage が実行され、ファイルのパス名を含むすべての SymDaemon の操作がログに記録されます。デスクトップ上の symdaemon.log をダブルクリックすると、mac のコンソールアプリケーションを使って内容をリアルタイムに見ることができます。
Mac コンソールアプリケーションは、ウィンドウの右上にある [検索] エリアに入力した文字列と一致する行だけを含むように、ログの表示をフィルタリングすることもできます。また、フィルタリングされたビューを新しいログファイルに保存することもできます。例えば eicar テストファイルに対するすべてのオープン操作の記録のみが必要な場合、[検索] エリアに "open eicar" と入力してください。
fs_usage の実行中に、ターミナル コマンド ラインに次のように入力すると、ログ ファイルを空にして再起動することができます。
> ~/Desktop/symdaemon.log
ログを停止する準備ができたら、次のように入力します。
sudo killall fs_usage
以下はアイドル状態の Mac からのログファイルの例で、オープン操作のみを表示するようにフィルタリングされています。圧縮ファイルの自動保護スキャンが有効になっています。
13:02:34.268072 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008E.tok 0.000070 SymDaemon.949 13:02:34.268108 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008E.tok 0.000028 SymDaemon.949 13:02:39.034659 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000016 SymDaemon.950 13:02:39.035545 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:39.036117 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:39.036208 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:39.036437 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008F.tok 0.000051 SymDaemon.949 13:02:39.036469 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000008F.tok 0.000026 SymDaemon.949 13:02:41.235027 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000026 SymDaemon.950 13:02:41.235919 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:41.236492 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:41.236562 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000013 SymDaemon.949 13:02:41.236763 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000090.tok 0.000062 SymDaemon.949 13:02:41.236795 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000090.tok 0.000026 SymDaemon.949 13:02:51.280318 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data 0.000025 SymDaemon.950 13:02:51.283946 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist 0.000014 SymDaemon.950 13:02:51.286407 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data 0.000013 SymDaemon.949 13:02:51.289351 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data 0.000013 SymDaemon.949 13:02:51.289862 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000091.tok 0.000062 SymDaemon.949 13:02:51.289908 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000091.tok 0.000038 SymDaemon.949 13:02:51.305457 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist 0.000015 SymDaemon.949 13:02:51.308111 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist 0.000013 SymDaemon.949 13:02:51.308374 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000092.tok 0.000053 SymDaemon.949 13:02:51.308406 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000092.tok 0.000025 SymDaemon.949 13:03:05.473887 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000024 SymDaemon.950 13:03:05.475173 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.950 13:03:05.477793 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:03:05.478664 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:03:05.478874 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000093.tok 0.000073 SymDaemon.949 13:03:05.478908 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000093.tok 0.000026 SymDaemon.949 13:03:05.481241 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000012 SymDaemon.949 13:03:05.483928 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.949 13:03:05.484168 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000094.tok 0.000046 SymDaemon.949 13:03:05.484199 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000094.tok 0.000024 SymDaemon.949 13:03:06.547550 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000024 SymDaemon.950 13:03:06.548448 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000013 SymDaemon.949 13:03:06.549029 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000012 SymDaemon.949 13:03:06.549236 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000095.tok 0.000061 SymDaemon.949 13:03:06.549270 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000095.tok 0.000026 SymDaemon.949 13:03:12.057672 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist 0.000025 SymDaemon.950 13:03:12.058693 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist 0.000013 SymDaemon.949 13:03:12.059341 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Console.LSSharedFileList.plist 0.000012 SymDaemon.949 13:03:12.059637 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000096.tok 0.000063 SymDaemon.949 13:03:12.059671 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000096.tok 0.000026 SymDaemon.949 13:03:30.193070 open F=21 (R_____) /private/var/db/locationd/clients.plist 0.000030 SymDaemon.950 13:03:30.194220 open F=21 (R_____) /private/var/db/locationd/clients.plist 0.000013 SymDaemon.949 13:03:30.194805 open F=21 (R_____) /private/var/db/locationd/clients.plist 0.000012 SymDaemon.949 13:03:30.195009 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000097.tok 0.000068 SymDaemon.949 13:03:30.195043 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000097.tok 0.000027 SymDaemon.949 13:03:32.795182 open F=21 (R_____) /Applications/Safari.app 0.000023 SymDaemon.8195 13:03:32.795282 open F=21 (R_____) /Applications/Safari.app/Contents 0.000020 SymDaemon.8195 13:03:32.795390 open F=21 (R_____) /Applications/Safari.app/Contents/Info.plist 0.000026 SymDaemon.8195 13:03:32.795903 open F=21 (R_____) /Applications/Safari.app/Contents/PkgInfo 0.000039 SymDaemon.8195 13:03:33.937837 open F=21 (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework 0.000010 SymDaemon.8195 13:03:33.937960 open F=21 (R_____) A/Resources 0.000016 SymDaemon.8195 13:03:33.938056 open F=21 (R_____) A/Resources/Info.plist 0.000027 SymDaemon.8195 13:03:33.938489 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/Contents>>>>>>>>>>>>>>>>>>>>> 0.000015 SymDaemon.8195 13:03:33.938511 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support Files>>>>>>>>>>>>>>>> 0.000012 SymDaemon.8195 13:03:33.938531 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/PkgInfo 0.000012 SymDaemon.8195 13:03:35.746456 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000026 SymDaemon.950 13:03:35.748028 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000014 SymDaemon.950 13:03:35.750901 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000025 SymDaemon.950 13:03:35.751844 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.950 13:03:35.752813 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:03:35.753820 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:03:35.754242 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000098.tok 0.000065 SymDaemon.949 13:03:35.754277 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000098.tok 0.000026 SymDaemon.949 13:03:35.757266 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.949 13:03:35.760008 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.949 13:03:35.760275 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000099.tok 0.000050 SymDaemon.949 13:03:35.760307 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/10000099.tok 0.000025 SymDaemon.949 13:03:35.760954 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000013 SymDaemon.949 13:03:35.761856 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000012 SymDaemon.949 13:03:35.762240 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009A.tok 0.000040 SymDaemon.949 13:03:35.762270 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009A.tok 0.000024 SymDaemon.949 13:03:35.766091 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.949 13:03:35.767116 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000012 SymDaemon.949 13:03:35.767614 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009B.tok 0.000056 SymDaemon.949 13:03:35.767645 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009B.tok 0.000024 SymDaemon.949 13:03:36.772356 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000020 SymDaemon.950 13:03:36.773550 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000013 SymDaemon.949 13:03:36.774185 open F=21 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000014 SymDaemon.949 13:03:36.774466 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009C.tok 0.000073 SymDaemon.949 13:03:36.774504 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009C.tok 0.000029 SymDaemon.949 13:03:40.309272 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data 0.000025 SymDaemon.950 13:03:40.311591 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist 0.000014 SymDaemon.950 13:03:40.332034 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data 0.000018 SymDaemon.949 13:03:40.332930 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data 0.000013 SymDaemon.949 13:03:40.333223 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009D.tok 0.000062 SymDaemon.949 13:03:40.333256 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009D.tok 0.000026 SymDaemon.949 13:03:40.334365 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist 0.000013 SymDaemon.949 13:03:40.341578 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist 0.000016 SymDaemon.949 13:03:40.341878 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009E.tok 0.000057 SymDaemon.949 13:03:40.341925 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009E.tok 0.000026 SymDaemon.949 13:03:40.841251 open F=21 (R_____) /Applications/iTunes.app 0.000022 SymDaemon.8195 13:03:40.841364 open F=21 (R_____) /Applications/iTunes.app/Contents 0.000020 SymDaemon.8195 13:03:40.841468 open F=21 (R_____) /Applications/iTunes.app/Contents/Info.plist 0.000026 SymDaemon.8195 13:03:40.842240 open F=21 (R_____) /Applications/iTunes.app/Contents/PkgInfo 0.000024 SymDaemon.8195 13:03:42.216811 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000015 SymDaemon.950 13:03:42.222765 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000013 SymDaemon.949 13:03:42.229259 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000014 SymDaemon.949 13:03:44.389992 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000212 W SymDaemon.950 13:03:44.392944 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000014 SymDaemon.950 13:03:44.395188 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data 0.000015 SymDaemon.950 13:03:44.395885 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist 0.000013 SymDaemon.950 13:03:44.396224 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000013 SymDaemon.949 13:03:44.397107 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000013 SymDaemon.949 13:03:44.397527 open F=23 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009F.tok 0.000061 SymDaemon.949 13:03:44.397561 open F=23 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/1000009F.tok 0.000027 SymDaemon.949 13:03:44.427401 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000015 SymDaemon.949 13:03:44.428513 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.949 13:03:44.429012 open F=23 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A0.tok 0.000052 SymDaemon.949 13:03:44.429044 open F=23 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A0.tok 0.000025 SymDaemon.949 13:03:44.447497 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000016 SymDaemon.950 13:03:44.460196 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data 0.000016 SymDaemon.949 13:03:44.461007 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/data.data 0.000013 SymDaemon.949 13:03:44.461170 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A1.tok 0.000048 SymDaemon.949 13:03:44.461202 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A1.tok 0.000025 SymDaemon.949 13:03:44.491527 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist 0.000015 SymDaemon.949 13:03:44.573513 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.iTunes.savedState/windows.plist 0.000016 SymDaemon.949 13:03:44.573775 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A2.tok 0.000058 SymDaemon.949 13:03:44.573809 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A2.tok 0.000026 SymDaemon.949 13:03:44.574809 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:44.575883 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:44.576252 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A3.tok 0.000042 SymDaemon.949 13:03:44.576283 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A3.tok 0.000025 SymDaemon.949 13:03:45.729595 open F=21 (R_____) /Users/admin/Library/Safari/TopSites.plist 0.000018 SymDaemon.950 13:03:45.730511 open F=21 (R_____) /Users/admin/Library/Safari/LastSession.plist 0.000013 SymDaemon.950 13:03:45.731245 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.950 13:03:45.731984 open F=21 (R_____) /Users/admin/Library/Safari/TopSites.plist 0.000012 SymDaemon.949 13:03:45.732597 open F=21 (R_____) /Users/admin/Library/Safari/TopSites.plist 0.000012 SymDaemon.949 13:03:45.732782 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A4.tok 0.000059 SymDaemon.949 13:03:45.732815 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A4.tok 0.000026 SymDaemon.949 13:03:45.733356 open F=21 (R_____) /Users/admin/Library/Safari/LastSession.plist 0.000012 SymDaemon.949 13:03:45.733971 open F=21 (R_____) /Users/admin/Library/Safari/LastSession.plist 0.000012 SymDaemon.949 13:03:45.734131 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A5.tok 0.000039 SymDaemon.949 13:03:45.734162 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A5.tok 0.000024 SymDaemon.949 13:03:45.734750 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000012 SymDaemon.949 13:03:45.735441 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000012 SymDaemon.949 13:03:45.735583 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A6.tok 0.000039 SymDaemon.949 13:03:45.735613 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A6.tok 0.000024 SymDaemon.949 13:03:46.029306 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000024 SymDaemon.950 13:03:46.030559 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:46.031369 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:46.031816 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A7.tok 0.000065 SymDaemon.949 13:03:46.031864 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A7.tok 0.000027 SymDaemon.949 13:03:47.777930 open F=21 (R_____) /Applications/App Store.app 0.000025 SymDaemon.8195 13:03:47.778055 open F=21 (R_____) /Applications/App Store.app/Contents 0.000021 SymDaemon.8195 13:03:47.778160 open F=21 (R_____) /Applications/App Store.app/Contents/Info.plist 0.000026 SymDaemon.8195 13:03:47.778335 open F=21 (R_____) /Applications/App Store.app/Contents/PkgInfo 0.000023 SymDaemon.8195 13:03:48.855144 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000015 SymDaemon.950 13:03:48.856201 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000014 SymDaemon.950 13:03:48.857009 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000012 SymDaemon.950 13:03:48.857642 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.950 13:03:48.858358 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000012 SymDaemon.949 13:03:48.858994 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000012 SymDaemon.949 13:03:48.859262 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A8.tok 0.000076 SymDaemon.949 13:03:48.859300 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A8.tok 0.000029 SymDaemon.949 13:03:48.875228 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000015 SymDaemon.949 13:03:48.876250 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000012 SymDaemon.949 13:03:48.876423 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A9.tok 0.000049 SymDaemon.949 13:03:48.876455 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000A9.tok 0.000025 SymDaemon.949 13:03:48.990642 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000017 SymDaemon.949 13:03:48.992131 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000021 SymDaemon.949 13:03:48.992491 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AA.tok 0.000159 SymDaemon.949 13:03:48.992531 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AA.tok 0.000031 SymDaemon.949 13:03:48.993716 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000018 SymDaemon.949 13:03:49.014390 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db 0.000026 SymDaemon.950 13:03:49.018088 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db 0.000013 SymDaemon.950 13:03:49.019323 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000014 SymDaemon.950 13:03:49.020241 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000012 SymDaemon.950 13:03:49.021168 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db 0.000014 SymDaemon.950 13:03:49.022086 open F=22 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db 0.000013 SymDaemon.950 13:03:49.105892 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.949 13:03:49.106098 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AB.tok 0.000051 SymDaemon.949 13:03:49.106131 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AB.tok 0.000026 SymDaemon.949 13:03:49.107452 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db 0.000151 W SymDaemon.949 13:03:49.108899 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsObject.db 0.000014 SymDaemon.949 13:03:49.109316 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AC.tok 0.000048 SymDaemon.949 13:03:49.109349 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AC.tok 0.000025 SymDaemon.949 13:03:49.261103 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db 0.000014 SymDaemon.949 13:03:49.262318 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.appstore/mds/mdsDirectory.db 0.000014 SymDaemon.949 13:03:49.262840 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AD.tok 0.000070 SymDaemon.949 13:03:49.262874 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AD.tok 0.000027 SymDaemon.949 13:03:49.318982 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000017 SymDaemon.949 13:03:49.320177 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000013 SymDaemon.949 13:03:49.320595 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AE.tok 0.000054 SymDaemon.949 13:03:49.320627 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AE.tok 0.000025 SymDaemon.949 13:03:49.469812 open F=22 (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions 0.000011 SymDaemon.8196 13:03:49.469954 open F=22 (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions 0.000010 SymDaemon.8196 13:03:49.470041 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Contents>>>>>>>>>>>>>>> 0.000009 SymDaemon.8196 13:03:49.470059 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Support Files>>>>>>>>>> 0.000008 SymDaemon.8196 13:03:49.470074 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/PkgInfo 0.000007 SymDaemon.8196 13:03:49.498642 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000016 SymDaemon.949 13:03:49.499790 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.949 13:03:49.500309 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AF.tok 0.000053 SymDaemon.949 13:03:49.500341 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000AF.tok 0.000025 SymDaemon.949 13:03:49.505639 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db 0.000017 SymDaemon.949 13:03:49.507048 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsObject.db 0.000017 SymDaemon.949 13:03:49.507494 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B0.tok 0.000066 SymDaemon.949 13:03:49.507528 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B0.tok 0.000027 SymDaemon.949 13:03:49.509300 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db 0.000014 SymDaemon.949 13:03:49.510396 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.appstore/mds/mdsDirectory.db 0.000013 SymDaemon.949 13:03:49.510891 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B1.tok 0.000045 SymDaemon.949 13:03:49.510923 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B1.tok 0.000024 SymDaemon.949 13:03:49.530932 open F=21 (R_____) /System/Library/CoreServices/ManagedClient.app 0.000010 SymDaemon.8195 13:03:49.531013 open F=21 (R_____) /System/Library/CoreServices/ManagedClient.app/Contents 0.000011 SymDaemon.8195 13:03:49.531102 open F=21 (R_____) /System/Library/CoreServices/ManagedClient.app/Contents/Info.plist 0.000022 SymDaemon.8195 13:03:49.531224 open F=21 (R_____) /System/Library/CoreServices/ManagedClient.app/Contents/PkgInfo 0.000023 SymDaemon.8195 13:03:50.949531 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000022 SymDaemon.950 13:03:50.952195 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000029 SymDaemon.949 13:03:50.953736 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000022 SymDaemon.949 13:03:50.954603 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B2.tok 0.000074 SymDaemon.949 13:03:50.954640 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B2.tok 0.000028 SymDaemon.949 13:03:51.013404 open F=23 (R_____) /private/var/db/crls/ocspcache.db 0.000027 SymDaemon.950 13:03:51.014626 open F=23 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.950 13:03:51.015468 open F=23 (R_____) /Users/admin/Library/Caches/com.apple.storeagent/updates.plist 0.000014 SymDaemon.950 13:03:51.016121 open F=23 (R_____) /Users/admin/Library/Cookies/com.apple.appstore.cookies 0.000013 SymDaemon.950 13:03:51.016751 open F=23 (R_____) /Library/Application Support/App Store/adoption.plist 0.000013 SymDaemon.950 13:03:51.017400 open F=23 (R_____) /private/var/db/launchd.db/com.apple.launchd/overrides.plist 0.000013 SymDaemon.950 13:03:51.018014 open F=23 (R_____) /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist 0.000025 SymDaemon.950 13:03:51.019227 open F=23 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist 0.000014 SymDaemon.950 13:03:51.047127 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist 0.000017 SymDaemon.950 13:03:51.048112 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist 0.000013 SymDaemon.950 13:03:51.048859 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.nsservicescache.plist 0.000013 SymDaemon.950 13:03:51.050043 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000013 SymDaemon.949 13:03:51.050852 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.949 13:03:51.051252 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B3.tok 0.000054 SymDaemon.949 13:03:51.051284 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B3.tok 0.000025 SymDaemon.949 13:03:51.074181 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.949 13:03:51.075109 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000012 SymDaemon.949 13:03:51.075291 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B4.tok 0.000045 SymDaemon.949 13:03:51.075323 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B4.tok 0.000025 SymDaemon.949 13:03:51.094970 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.storeagent/updates.plist 0.000016 SymDaemon.949 13:03:51.095786 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.storeagent/updates.plist 0.000013 SymDaemon.949 13:03:51.095970 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B5.tok 0.000052 SymDaemon.949 13:03:51.096002 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B5.tok 0.000025 SymDaemon.949 13:03:51.127147 open F=21 (R_____) /Users/admin/Library/Cookies/com.apple.appstore.cookies 0.000016 SymDaemon.949 13:03:51.127955 open F=21 (R_____) /Users/admin/Library/Cookies/com.apple.appstore.cookies 0.000012 SymDaemon.949 13:03:51.128160 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B6.tok 0.000053 SymDaemon.949 13:03:51.128192 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B6.tok 0.000025 SymDaemon.949 13:03:51.145362 open F=21 (R_____) /Library/Application Support/App Store/adoption.plist 0.000014 SymDaemon.949 13:03:51.146177 open F=21 (R_____) /Library/Application Support/App Store/adoption.plist 0.000012 SymDaemon.949 13:03:51.146259 open F=22 (R_____) /Library/Application Support/App Store/adoption.plist 0.000012 SymDaemon.949 13:03:51.146436 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B7.tok 0.000050 SymDaemon.949 13:03:51.146467 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B7.tok 0.000025 SymDaemon.949 13:03:51.164358 open F=21 (R_____) /private/var/db/launchd.db/com.apple.launchd/overrides.plist 0.000016 SymDaemon.949 13:03:51.165194 open F=21 (R_____) /private/var/db/launchd.db/com.apple.launchd/overrides.plist 0.000012 SymDaemon.949 13:03:51.165264 open F=22 (R_____) /private/var/db/launchd.db/com.apple.launchd/overrides.plist 0.000012 SymDaemon.949 13:03:51.165435 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B8.tok 0.000052 SymDaemon.949 13:03:51.165466 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B8.tok 0.000025 SymDaemon.949 13:03:51.179368 open F=21 (R_____) /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist 0.000026 SymDaemon.949 13:03:51.180143 open F=21 (R_____) /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist 0.000021 SymDaemon.949 13:03:51.180216 open F=22 (R_____) /private/var/db/ConfigurationProfiles/com.apple.ManagedClient.enrollagent.plist 0.000020 SymDaemon.949 13:03:51.180391 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B9.tok 0.000047 SymDaemon.949 13:03:51.180421 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000B9.tok 0.000024 SymDaemon.949 13:03:51.241986 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist 0.000014 SymDaemon.949 13:03:51.243114 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist 0.000012 SymDaemon.949 13:03:51.243706 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BA.tok 0.000058 SymDaemon.949 13:03:51.243739 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BA.tok 0.000026 SymDaemon.949 13:03:51.463647 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist 0.000016 SymDaemon.949 13:03:51.464705 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist 0.000013 SymDaemon.949 13:03:51.464935 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BB.tok 0.000053 SymDaemon.949 13:03:51.465020 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BB.tok 0.000079 SymDaemon.949 13:03:51.468332 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist 0.000014 SymDaemon.949 13:03:51.469153 open F=21 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.appstore.playlist 0.000013 SymDaemon.949 13:03:51.469393 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BC.tok 0.000044 SymDaemon.949 13:03:51.469423 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BC.tok 0.000024 SymDaemon.949 13:03:51.474846 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.nsservicescache.plist 0.000013 SymDaemon.949 13:03:51.477227 open F=21 (R_____) /Users/admin/Library/Caches/com.apple.nsservicescache.plist 0.000018 SymDaemon.949 13:03:51.477536 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BD.tok 0.000071 SymDaemon.949 13:03:51.477573 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BD.tok 0.000029 SymDaemon.949 13:03:53.387589 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library.itl 0.000025 SymDaemon.950 13:03:53.391003 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Extras.itdb 0.000014 SymDaemon.950 13:03:53.392889 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000013 SymDaemon.950 13:03:53.393453 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library.itl 0.000012 SymDaemon.949 13:03:53.397652 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library.itl 0.000013 SymDaemon.949 13:03:53.398128 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BE.tok 0.000063 SymDaemon.949 13:03:53.398163 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BE.tok 0.000027 SymDaemon.949 13:03:53.399048 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Extras.itdb 0.000012 SymDaemon.949 13:03:53.400789 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Extras.itdb 0.000012 SymDaemon.949 13:03:53.401775 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BF.tok 0.000041 SymDaemon.949 13:03:53.401806 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000BF.tok 0.000025 SymDaemon.949 13:03:53.403029 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000012 SymDaemon.949 13:03:53.403542 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000012 SymDaemon.949 13:03:53.403666 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C0.tok 0.000038 SymDaemon.949 13:03:53.403696 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C0.tok 0.000024 SymDaemon.949 13:04:00.547142 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000024 SymDaemon.950 13:04:00.548411 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000013 SymDaemon.949 13:04:00.549268 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000012 SymDaemon.949 13:04:00.549465 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C1.tok 0.000060 SymDaemon.949 13:04:00.549499 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C1.tok 0.000026 SymDaemon.949 13:04:03.157699 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000025 SymDaemon.950 13:04:03.158584 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000013 SymDaemon.950 13:04:03.159448 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.950 13:04:03.160108 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000013 SymDaemon.950 13:04:03.161050 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.appstore.plist 0.000013 SymDaemon.950 13:04:03.161717 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.storeagent.plist 0.000013 SymDaemon.950 13:04:03.162340 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000012 SymDaemon.949 13:04:03.162976 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000012 SymDaemon.949 13:04:03.163193 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C2.tok 0.000066 SymDaemon.949 13:04:03.163227 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C2.tok 0.000026 SymDaemon.949 13:04:03.163702 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000012 SymDaemon.949 13:04:03.164429 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000012 SymDaemon.949 13:04:03.164572 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C3.tok 0.000039 SymDaemon.949 13:04:03.164603 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C3.tok 0.000024 SymDaemon.949 13:04:03.173689 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.949 13:04:03.175251 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.949 13:04:03.175413 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C4.tok 0.000043 SymDaemon.949 13:04:03.175444 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C4.tok 0.000024 SymDaemon.949 13:04:03.175838 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000012 SymDaemon.949 13:04:03.176725 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000012 SymDaemon.949 13:04:03.176865 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C5.tok 0.000039 SymDaemon.949 13:04:03.176907 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C5.tok 0.000036 SymDaemon.949 13:04:03.177854 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.appstore.plist 0.000012 SymDaemon.949 13:04:03.178457 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.appstore.plist 0.000012 SymDaemon.949 13:04:03.178620 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C6.tok 0.000039 SymDaemon.949 13:04:03.178651 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C6.tok 0.000024 SymDaemon.949 13:04:03.179437 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.storeagent.plist 0.000012 SymDaemon.949 13:04:03.180003 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.storeagent.plist 0.000012 SymDaemon.949 13:04:03.180137 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C7.tok 0.000038 SymDaemon.949 13:04:03.180167 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C7.tok 0.000024 SymDaemon.949 13:04:10.997639 open F=21 (R_____) /Users/admin/Desktop/OFF.log 0.000024 SymDaemon.950 13:04:10.998761 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db-wal 0.000014 SymDaemon.950 13:04:10.999343 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db 0.000013 SymDaemon.950 13:04:11.001468 open F=21 (R_____) /Users/admin/Desktop/OFF.log 0.000012 SymDaemon.949 13:04:11.002370 open F=21 (R_____) /Users/admin/Desktop/OFF.log 0.000012 SymDaemon.949 13:04:11.002449 open F=22 (R_____) /Users/admin/Desktop/OFF.log 0.000012 SymDaemon.949 13:04:11.002655 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C8.tok 0.000068 SymDaemon.949 13:04:11.002688 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C8.tok 0.000026 SymDaemon.949 13:04:11.045240 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db-wal 0.000014 SymDaemon.949 13:04:11.045786 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db-wal 0.000012 SymDaemon.949 13:04:11.045946 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db 0.000012 SymDaemon.949 13:04:11.049096 open F=21 (R_____) /Users/admin/Library/IdentityServices/ids.db 0.000012 SymDaemon.949 13:04:11.050999 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C9.tok 0.000051 SymDaemon.949 13:04:11.051031 open F=22 (RWC_T_) /private/tmp/4e-14-07-16-Wed-10-46-59-Zj/100000C9.tok
以下はアイドル状態の Mac からのログファイルの例で、オープン操作のみを表示するようにフィルタリングされています。圧縮ファイルの自動保護スキャンが無効になっています。
12:59:12.200034 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000026 SymDaemon.950 12:59:13.788970 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/data.data 0.000025 SymDaemon.950 12:59:13.791806 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Terminal.savedState/windows.plist 0.000014 SymDaemon.950 12:59:14.866217 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/thumbnails.fraghandler 0.000028 SymDaemon.950 12:59:20.881158 open F=20 (R_____) /private/var/root/Library/Preferences/com.apple.xpc.activity.plist 0.000025 SymDaemon.950 12:59:28.180117 open F=20 (R_____) /private/var/db/systemstats/snapshots.db-wal 0.000026 SymDaemon.950 12:59:28.180971 open F=20 (R_____) /private/var/db/systemstats/snapshots.db 0.000013 SymDaemon.950 12:59:45.493017 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000025 SymDaemon.950 12:59:45.494278 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/windows.plist 0.000013 SymDaemon.950 13:00:02.824416 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000028 SymDaemon.950 13:00:12.177829 open F=20 (R_____) /Applications/Safari.app 0.000030 SymDaemon.7119 13:00:12.180053 open F=20 (R_____) /Applications/Safari.app/Contents 0.000026 SymDaemon.7119 13:00:12.180168 open F=20 (R_____) /Applications/Safari.app/Contents/Info.plist 0.000028 SymDaemon.7119 13:00:12.180667 open F=20 (R_____) /Applications/Safari.app/Contents/PkgInfo 0.000024 SymDaemon.7119 13:00:12.626987 open F=20 (R_____) /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app 0.000013 SymDaemon.7119 13:00:12.627083 open F=20 (R_____) /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents 0.000012 SymDaemon.7119 13:00:12.627177 open F=20 (R_____) /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/Info.plist 0.000027 SymDaemon.7119 13:00:12.627332 open F=20 (R_____) /System/Library/Frameworks/PubSub.framework/Versions/A/Resources/PubSubAgent.app/Contents/PkgInfo 0.000023 SymDaemon.7119 13:00:13.085954 open F=20 (R_____) A/Frameworks/LaunchServices.framework 0.000018 SymDaemon.7119 13:00:13.086077 open F=20 (R_____) A/Resources 0.000018 SymDaemon.7119 13:00:13.086376 open F=20 (R_____) A/Resources/Info.plist 0.000052 SymDaemon.7119 13:00:13.089136 open [ 2] (R_____) A/Frameworks/LaunchServices.framework/Contents>>>>>>>>>> 0.000013 SymDaemon.7119 13:00:13.089158 open [ 2] (R_____) A/Frameworks/LaunchServices.framework/Support Files>>>>> 0.000011 SymDaemon.7119 13:00:13.089177 open [ 2] (R_____) A/Frameworks/LaunchServices.framework/PkgInfo 0.000010 SymDaemon.7119 13:00:13.089346 open F=20 (R_____) /System 0.000020 SymDaemon.7119 13:00:13.089476 open F=20 (R_____) /System 0.000009 SymDaemon.7119 13:00:13.089543 open [ 2] (R_____) /System/Contents>>>>>>>> 0.000007 SymDaemon.7119 13:00:13.089558 open [ 2] (R_____) /System/Support Files>>> 0.000007 SymDaemon.7119 13:00:13.089571 open [ 2] (R_____) /System/PkgInfo 0.000006 SymDaemon.7119 13:00:13.273182 open F=20 (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework 0.000011 SymDaemon.7119 13:00:13.289982 open F=20 (R_____) A/Resources 0.000017 SymDaemon.7119 13:00:13.290069 open F=20 (R_____) A/Resources/Info.plist 0.000027 SymDaemon.7119 13:00:13.290508 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/Contents>>>>>>>>>>>>>>>>>>>>> 0.000009 SymDaemon.7119 13:00:13.290525 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/Support Files>>>>>>>>>>>>>>>> 0.000008 SymDaemon.7119 13:00:13.290540 open [ 2] (R_____) /System/Library/PrivateFrameworks/SyncedDefaults.framework/PkgInfo 0.000007 SymDaemon.7119 13:00:14.012005 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000022 SymDaemon.950 13:00:14.013483 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.PubSubAgent.plist 0.000013 SymDaemon.950 13:00:14.014209 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000013 SymDaemon.950 13:00:15.048007 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore 0.000016 SymDaemon.950 13:00:15.049234 open F=20 (R_____) /Users/admin/Library/SyncedPreferences/com.apple.syncedpreferences.plist 0.000014 SymDaemon.950 13:00:15.050043 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.WebContent+com.apple.Safari/com.apple.sandbox/sandbox-cache.db 0.000014 SymDaemon.950 13:00:15.051103 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.IconServices/6100D2A3FF19F8B18C1B86F91DBC3BC5.iscachebmp 0.000013 SymDaemon.950 13:00:16.050942 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.WebKit.Networking+com.apple.Safari/com.apple.sandbox/sandbox-cache.db 0.000022 SymDaemon.950 13:00:17.140451 open F=20 (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions 0.000015 SymDaemon.7119 13:00:17.157535 open F=20 (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions 0.000013 SymDaemon.7119 13:00:17.160556 open [ 2] (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions/Contents>>>>>>>>>>>>>>>>>>>>>>>> 0.000011 SymDaemon.7119 13:00:17.160573 open [ 2] (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions/Support Files>>>>>>>>>>>>>>>>>>> 0.000007 SymDaemon.7119 13:00:17.160597 open [ 2] (R_____) /System/Library/Frameworks/CFNetwork.framework/Versions/PkgInfo 0.000016 SymDaemon.7119 13:00:17.218248 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000031 SymDaemon.950 13:00:17.219648 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000013 SymDaemon.950 13:00:17.220892 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000013 SymDaemon.950 13:00:19.005893 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000024 SymDaemon.950 13:00:19.011780 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000016 SymDaemon.950 13:00:19.012747 open F=20 (R_____) /Users/admin/Library/Preferences/.GlobalPreferences.plist 0.000013 SymDaemon.950 13:00:19.013460 open F=20 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.950 13:00:19.014525 open F=20 (R_____) /Users/admin/Library/Safari/Configurations.plist.signed 0.000013 SymDaemon.950 13:00:19.015608 open F=20 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000029 SymDaemon.950 13:00:19.077770 open F=20 (R_____) /Users/admin/Library/PubSub/Clients.plist 0.000013 SymDaemon.950 13:00:19.802168 open F=20 (R_____) /Applications/Safari.app 0.000024 SymDaemon.7149 13:00:19.802274 open F=20 (R_____) /Applications/Safari.app/Contents 0.000020 SymDaemon.7149 13:00:19.802384 open F=20 (R_____) /Applications/Safari.app/Contents/Info.plist 0.000028 SymDaemon.7149 13:00:19.802887 open F=20 (R_____) /Applications/Safari.app/Contents/PkgInfo 0.000023 SymDaemon.7149 13:00:21.769278 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.help.plist 0.000029 SymDaemon.950 13:00:21.770498 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000013 SymDaemon.950 13:00:21.771249 open F=20 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist 0.000014 SymDaemon.950 13:00:21.773267 open F=20 (R_____) /Users/admin/Library/Preferences/QuickTime Preferences 0.000014 SymDaemon.950 13:00:21.774499 open F=20 (R_____) /Users/admin/Library/Preferences/com.apple.quicktime.plugin.preferences.plist 0.000014 SymDaemon.950 13:00:21.775551 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/77C0C2D0-E042-437A-9100-D27CA7FD2425.webbookmark 0.000013 SymDaemon.950 13:00:21.777461 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/C6031387-61B7-49B1-8A9A-D7C6C87DE78D.webbookmark 0.000015 SymDaemon.950 13:00:21.778163 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/83EEF489-E547-42F6-863B-354E93A680A2.webbookmark 0.000013 SymDaemon.950 13:00:21.778786 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/47035D3E-FDF5-48F1-B517-F0A00E521C07.webbookmark 0.000014 SymDaemon.950 13:00:22.181192 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/B4B283AB-C684-47CA-9B1F-8C4F06B21572.webbookmark 0.000017 SymDaemon.950 13:00:22.182105 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/6B057C96-609F-4B63-8E37-14FA085A1C4C.webbookmark 0.000014 SymDaemon.950 13:00:22.182768 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/3FCC16BB-E56A-4DB5-8941-33170A67B99F.webbookmark 0.000014 SymDaemon.950 13:00:22.183478 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/402ADB1C-C3C0-4CD1-8158-B45C4D8E438C.webbookmark 0.000013 SymDaemon.950 13:00:22.184158 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/CCDEA395-8D07-4670-8308-1471D7793EB1.webbookmark 0.000013 SymDaemon.950 13:00:22.184815 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/E5DDF305-0348-4C54-8D36-B165C79984D8.webbookmark 0.000013 SymDaemon.950 13:00:22.186045 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/3CDDF82B-8590-4963-9D41-066DB0574505.webbookmark 0.000014 SymDaemon.950 13:00:22.186705 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/62A98F7F-5C73-497C-AC5A-B48FE618D404.webbookmark 0.000013 SymDaemon.950 13:00:22.187574 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/DA234375-1282-4BC8-81D8-25EA4B638E69.webbookmark 0.000013 SymDaemon.950 13:00:22.188271 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/9B6374E2-DA43-4F4C-BDA0-BF382E17521F.webbookmark 0.000013 SymDaemon.950 13:00:22.188939 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/6D51CBD4-03FA-4370-AD96-CF956F2D17BF.webbookmark 0.000013 SymDaemon.950 13:00:22.189558 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/C3248BD4-C35F-48F4-B58F-A6D6EE78BE1E.webbookmark 0.000013 SymDaemon.950 13:00:22.190367 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/78C8B380-4513-455B-B6DF-AD0B83043243.webbookmark 0.000013 SymDaemon.950 13:00:22.191011 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/2817963C-D664-42D1-89C5-B8C8912CADCB.webbookmark 0.000013 SymDaemon.950 13:00:22.191652 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/96441F34-A8FD-46D9-A524-7050100186A0.webbookmark 0.000013 SymDaemon.950 13:00:22.201184 open F=20 (R_____) /Users/admin/Library/Caches/Metadata/Safari/Bookmarks/93915673-0C21-4AC6-A67B-7F9D4B9A5559.webbookmark 0.000015 SymDaemon.950 13:00:22.201955 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/data.data 0.000013 SymDaemon.950 13:00:22.202907 open F=20 (R_____) /Users/admin/Library/Saved Application State/com.apple.Safari.savedState/windows.plist 0.000013 SymDaemon.950 13:00:22.361589 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.dock.iconcache 0.000018 SymDaemon.950 13:00:23.187710 open F=20 (R_____) /System 0.000026 SymDaemon.7119 13:00:23.187866 open F=20 (R_____) /System 0.000009 SymDaemon.7119 13:00:23.187953 open [ 2] (R_____) /System/Contents>>>>>>>> 0.000008 SymDaemon.7119 13:00:23.187971 open [ 2] (R_____) /System/Support Files>>> 0.000007 SymDaemon.7119 13:00:23.187985 open [ 2] (R_____) /System/PkgInfo 0.000007 SymDaemon.7119 13:00:25.062208 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/75B9C4C4-FA40-4489-ABEA-FFB4221D1F8E 0.000027 SymDaemon.950 13:00:25.063510 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore 0.000014 SymDaemon.950 13:00:25.064300 open F=20 (R_____) /Users/admin/Library/Safari/TopSites.plist 0.000013 SymDaemon.950 13:00:25.065020 open F=20 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.QuickLook.thumbnailcache/index.sqlite 0.000014 SymDaemon.950 13:00:27.514080 open F=20 (R_____) /Users/admin/Library/Safari/WebpageIcons.db 0.000028 SymDaemon.950 13:00:27.516109 open F=20 (R_____) /Users/admin/Library/Safari/LastSession.plist 0.000014 SymDaemon.950 13:00:27.516849 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/580F555A-AD45-424B-9320-D743D877F596 0.000014 SymDaemon.950 13:00:27.517500 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/0A9C8198-8A19-43AD-A8FD-C598DCC46470 0.000013 SymDaemon.950 13:00:27.518067 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/FDBB7D0E-E4BC-4A29-97D7-9614754CE29C 0.000014 SymDaemon.950 13:00:27.518634 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/A66DFC9E-8067-49CA-889B-6C16C500DCD7 0.000013 SymDaemon.950 13:00:27.519947 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/21417647-DC56-4651-ADD2-C7024403FDCF 0.000014 SymDaemon.950 13:00:27.521247 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/2DE01F36-F367-4FBA-9804-A3AFC0B69A77 0.000013 SymDaemon.950 13:00:28.072682 open F=20 (R_____) /Applications/iTunes.app 0.000034 SymDaemon.7119 13:00:28.072798 open F=20 (R_____) /Applications/iTunes.app/Contents 0.000021 SymDaemon.7119 13:00:28.072908 open F=20 (R_____) /Applications/iTunes.app/Contents/Info.plist 0.000028 SymDaemon.7119 13:00:28.073588 open F=20 (R_____) /Applications/iTunes.app/Contents/PkgInfo 0.000024 SymDaemon.7119 13:00:28.074136 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/569AB7AC-CB4B-40A5-8F6F-C25F35360D23 0.000014 SymDaemon.950 13:00:28.075656 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/4A448E90-0FAD-40F9-9D9E-05C69D2522EE 0.000014 SymDaemon.950 13:00:28.076330 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/436642F8-8345-4886-9183-EE2986D0E2EA 0.000013 SymDaemon.950 13:00:28.077520 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.Safari/fsCachedData/09EB8C21-D2E6-4B1A-9A33-03999679763B 0.000013 SymDaemon.950 13:00:28.078199 open F=20 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.Safari.playlist 0.000013 SymDaemon.950 13:00:28.079107 open F=20 (R_____) /private/var/db/BootCaches/E6CCADAF-5E25-4100-A240-D365FF78FA00/app.com.apple.iTunes.playlist 0.000013 SymDaemon.950 13:00:28.079958 open F=20 (R_____) /Users/admin/Library/Caches/com.apple.nsservicescache.plist 0.000013 SymDaemon.950 13:00:28.080919 open F=20 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.950 13:00:30.134883 open F=20 (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions 0.000016 SymDaemon.7119 13:00:30.135032 open F=20 (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions 0.000010 SymDaemon.7119 13:00:30.135106 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Contents>>>>>>>>>>>>>>> 0.000009 SymDaemon.7119 13:00:30.135124 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/Support Files>>>>>>>>>> 0.000007 SymDaemon.7119 13:00:30.135139 open [ 2] (R_____) /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/PkgInfo 0.000008 SymDaemon.7119 13:00:30.135477 open F=20 (R_____) /Users/admin/Library/Caches/QCCompositionRepository-com.apple.iTunes.cache 0.000014 SymDaemon.950 13:00:30.136715 open F=20 (R_____) /Users/admin/Music/iTunes/sentinel 0.000013 SymDaemon.950 13:00:30.138054 open F=20 (R_____) /Users/admin/Music/iTunes/iTunes Library Genius.itdb 0.000012 SymDaemon.950 13:00:30.168215 open F=20 (R_____) private/var/log/system.log 0.000022 SymDaemon.7149 13:00:31.008865 open F=21 (R_____) /Users/admin/Library/Containers/com.apple.BKAgentService/Container.plist 0.000015 SymDaemon.950 13:00:31.010139 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000012 SymDaemon.950 13:00:32.789758 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.sandbox/sandbox-cache.db 0.000019 SymDaemon.950 13:00:32.805909 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/.iTunes Preferences.plist 0.000016 SymDaemon.950 13:00:32.808049 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ar.strings 0.000031 SymDaemon.950 13:00:32.808772 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ca.strings 0.000028 SymDaemon.950 13:00:32.809719 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/cs.strings 0.000029 SymDaemon.950 13:00:32.810409 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/da.strings 0.000028 SymDaemon.950 13:00:32.811159 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Dutch.strings 0.000029 SymDaemon.950 13:00:32.811843 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/el.strings 0.000042 SymDaemon.950 13:00:32.812505 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/en_GB.strings 0.000028 SymDaemon.950 13:00:32.813186 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/English.strings 0.000028 SymDaemon.950 13:00:32.813833 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/fi.strings 0.000039 SymDaemon.950 13:00:32.814507 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/French.strings 0.000028 SymDaemon.950 13:00:32.815374 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/German.strings 0.000028 SymDaemon.950 13:00:32.816054 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/he.strings 0.000029 SymDaemon.950 13:00:32.816753 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/hr.strings 0.000028 SymDaemon.950 13:00:32.817638 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/hu.strings 0.000028 SymDaemon.950 13:00:32.818330 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/id.strings 0.000029 SymDaemon.950 13:00:32.820483 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Italian.strings 0.000031 SymDaemon.950 13:00:32.821200 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Japanese.strings 0.000029 SymDaemon.950 13:00:32.821889 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ko.strings 0.000028 SymDaemon.950 13:00:32.822581 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ms.strings 0.000027 SymDaemon.950 13:00:32.823278 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/no.strings 0.000029 SymDaemon.950 13:00:32.823948 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pl.strings 0.000028 SymDaemon.950 13:00:32.824654 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pt.strings 0.000027 SymDaemon.950 13:00:32.825612 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/pt_PT.strings 0.000031 SymDaemon.950 13:00:32.826292 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ro.strings 0.000028 SymDaemon.950 13:00:32.826983 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/ru.strings 0.000028 SymDaemon.950 13:00:32.827654 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/sk.strings 0.000027 SymDaemon.950 13:00:32.828318 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/Spanish.strings 0.000029 SymDaemon.950 13:00:32.828999 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/sv.strings 0.000028 SymDaemon.950 13:00:32.829660 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/th.strings 0.000028 SymDaemon.950 13:00:32.830343 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/tr.strings 0.000028 SymDaemon.950 13:00:32.831095 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/uk.strings 0.000028 SymDaemon.950 13:00:32.831760 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/vi.strings 0.000028 SymDaemon.950 13:00:32.832441 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/zh_CN.strings 0.000028 SymDaemon.950 13:00:32.833108 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Media/Automatically Add to iTunes.localized/.localized/zh_TW.strings 0.000028 SymDaemon.950 13:00:32.833797 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsObject.db 0.000014 SymDaemon.950 13:00:32.834776 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/mds/mdsDirectory.db 0.000012 SymDaemon.950 13:00:33.171149 open F=21 (R_____) /System 0.000026 SymDaemon.7149 13:00:33.171310 open F=21 (R_____) /System 0.000009 SymDaemon.7149 13:00:33.171384 open [ 2] (R_____) /System/Contents>>>>>>>> 0.000007 SymDaemon.7149 13:00:33.171401 open [ 2] (R_____) /System/Support Files>>> 0.000007 SymDaemon.7149 13:00:33.171415 open [ 2] (R_____) /System/PkgInfo 0.000007 SymDaemon.7149 13:00:33.173378 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.Safari.plist 0.000016 SymDaemon.950 13:00:33.174561 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.dock.plist 0.000013 SymDaemon.950 13:00:33.175599 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000013 SymDaemon.950 13:00:33.176470 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000013 SymDaemon.950 13:00:33.177131 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000014 SymDaemon.950 13:00:33.178044 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist 0.000019 SymDaemon.950 13:00:33.179497 open F=21 (R_____) /private/var/db/crls/ocspcache.db 0.000018 SymDaemon.950 13:00:33.180746 open F=21 (R_____) /Users/admin/Library/Containers/com.apple.BKAgentService/Data/Documents/iBooks/Books/Books.plist 0.000014 SymDaemon.950 13:00:33.182208 open F=21 (R_____) /Users/admin/Library/Cookies/com.apple.ibooks.cookies 0.000013 SymDaemon.950 13:00:33.182840 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.bookstoreagent.plist 0.000013 SymDaemon.950 13:00:35.179280 open F=21 (R_____) /private/var/folders/wv/6_vbty4n0h18k0tdkzyy7t000000gn/C/com.apple.LaunchServices-044501.csstore 0.000017 SymDaemon.950 13:00:35.180362 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library.itl 0.000013 SymDaemon.950 13:00:35.185564 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.loginitems.plist 0.000015 SymDaemon.950 13:00:35.186232 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Music Library.xml 0.000013 SymDaemon.950 13:00:35.948335 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000014 SymDaemon.7119 13:00:35.948503 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000012 SymDaemon.7119 13:00:35.948581 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Contents>>>>>>> 0.000012 SymDaemon.7119 13:00:35.948601 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Support Files>> 0.000010 SymDaemon.7119 13:00:35.948625 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/PkgInfo 0.000016 SymDaemon.7119 13:00:36.265471 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iApps.plist 0.000027 SymDaemon.950 13:00:36.266371 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Extras.itdb 0.000013 SymDaemon.950 13:00:36.267276 open F=21 (R_____) /Users/admin/Music/iTunes/iTunes Library Genius.itdb 0.000013 SymDaemon.950 13:00:36.268298 open F=21 (R_____) /Users/admin/Music/iTunes/sentinel 0.000013 SymDaemon.950 13:00:36.268894 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.eq.plist 0.000024 SymDaemon.950 13:00:36.269742 open F=21 (R_____) /Users/admin/Library/Cookies/Cookies.binarycookies 0.000013 SymDaemon.950 13:00:44.647426 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000027 SymDaemon.950 13:00:48.130293 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.iTunes.plist 0.000026 SymDaemon.950 13:00:48.131366 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.iTunes.000c29451655.plist 0.000013 SymDaemon.950 13:00:48.132192 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.bookstoreagent.plist 0.000013 SymDaemon.950 13:00:48.132858 open F=21 (R_____) /Users/admin/Library/Preferences/ByHost/com.apple.loginwindow.000c29451655.plist 0.000013 SymDaemon.950 13:00:48.133479 open F=21 (R_____) /Users/admin/Library/Preferences/com.apple.spaces.plist 0.000012 SymDaemon.950 13:00:49.012579 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000014 SymDaemon.7119 13:00:49.012727 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000012 SymDaemon.7119 13:00:49.012804 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Contents>>>>>>> 0.000011 SymDaemon.7119 13:00:49.012836 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Support Files>> 0.000022 SymDaemon.7119 13:00:49.012854 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/PkgInfo 0.000010 SymDaemon.7119 13:00:49.016564 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000013 SymDaemon.7119 13:00:49.016698 open F=21 (R_____) A/Frameworks/Metadata.framework/Versions 0.000012 SymDaemon.7119 13:00:49.016772 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Contents>>>>>>> 0.000011 SymDaemon.7119 13:00:49.016792 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/Support Files>> 0.000010 SymDaemon.7119 13:00:49.016810 open [ 2] (R_____) A/Frameworks/Metadata.framework/Versions/PkgInfo 0.000010 SymDaemon.7119 13:00:58.131598 open F=21 (R_____) /Users/admin/Library/Saved Application State/com.apple.Console.savedState/data.data 0.000025 SymDaemon.950
Additional Information
Feedback
Yes
No
Powered by
