Apple

Hi All,

I am writing application to list all process and opened files by the process, where I am able to get the process information like Pid,ppid, path, process commadline arguments etc using sysctl()( followed this link http://developer.apple.com/qa/qa2001/qa1123.html) .

I am using the following code to get the file information about every process.

int mib[3];

struct extern_file *file = NULL ; // Is it the correct structure ?

mib[0] = CTL_KERN;

mib[1] = KERN_MAXFILES;

mib[2] = 1693 ;

size = sizeof(argmax) ;

if (sysctl((int *)mib, 2, &argmax, &size, NULL, 0) < 0) {

printf("No args found\n");

printf("Error is %s\n", strerror(errno)) ;

}

else

{

printf("size is Given as %d\n",argmax) ; // argmax is giving me the correct values (i.e. count of all opened files )

size = (size_t)argmax ;

mib[0] = CTL_KERN; // Here I am resetting the mib arry for getting per process file information .

mib[1] = KERN_FILE;

mib[2] = 1693 ;//1693 ;//procList[i].kp_proc.p_pid;

file =(extern_file*) malloc(argmax);

if(file == NULL)

{

printf("file pointe not allocated yes\n") ;

}

if (sysctl((int *)mib, 3, fileNew, &size, NULL, 0) < 0)

{

printf("Error in getting file struct %s\n", strerror(errno)) ;

}

else

{

// Print file attributes

}

I want to list all file descriptors file paths and other file attributes , which I am not getting with this program and getting an error “Not a directory” during second sysctl call, where as getting the correct file count after first sysctl() call.

According to the man page of sysctl() KERN_FILE will return a file structure which is not at all documented ( not confirm about the structure to use ), there is no file structure exposed on Mac OS X (apart from extern_file and filedesc),

I am not sure which structure to use ? is it possible to get per process file information using KERN_FILE?

Is it the correct approach or there is any other way to get the same ?

OS version is 10.4.7

Thanks in advance!

Regards,

Manish.