On 30 Mar 2012, at 20:19, simran charley wrote:

Here after file closed with dirty = true, means file modification done, then what is the significance of last event {WRITE_DATA ACCESS} ?

It's hard to say without more info (I suspect it's copying some metadata). Why not set a breakpoint in your kauth listener and look at the backtrace? Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.... This email sent to site_archiver@lists.apple.com