On Jun 17, 2004, at 15:24, Brian Bergstrand wrote: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Jun 17, 2004, at 4:42 PM, Justin Walker wrote: On Jun 17, 2004, at 14:15, Krishna Monian wrote: [snip] The only way to do this is with some kind of kernel assistance. Hacking into dispatch tables won't, in all likelihood, survive new releases of the kernel, though. This approach is frowned on. I'd suggest, as someone already has, looking at ktrace, or perhaps, fs_usage. The source for both is available. This is a polling type of interface, though, so you need to apply it with some care and forethought. There is no notification mechanism for file access. That's not quite true. If the OP can require Darwin7+, then he can use the kqueue interface to get everything he needs except for reads -- and w/o polling or being in the kernel. See <sys/event.h>. That's right; I'd forgotten about kqueue (one of many new tricks I need to learn). My point about kernel assistance was that some sort of kernel mechanism, like those used by ktrace/fs_usage, is needed. There is no good reason to implement something new inside the kernel, for the oft-mentioned variety of reasons that can be found in the archives. For tracking reads, I think you are SOL. Thanks for the correction. Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | "Weaseling out of things is what | separates us from the animals. | Well, except the weasel." | - Homer J Simpson *--------------------------------------*-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.