site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=fyM0YeufeCNYOJajDy2cYCcQT45N9sJboj3iAdOfBS4=; b=i0S2ToWBaBroCOXfk4Pdg5Luf+c5mXZO8C/z4MxI2AFWfkNezFquyMFpprUh+XNVfM ta2wgVHmbeib+7BRw0nmL27LP3tyLrSi1lJwueVp6JQ0Syp9tFUOt92DNNx2TI3dIojp kVFqiqGBqEhUsWWIobUZNtrzK3TdY7IhEAAZ8= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=U0K2bN/h9oJYhD7qBEc7Lcjdt8rrTqTELrN7EYvSGGKPEAcV5ahbevmvC3czsyjjb2 HiEBX1clw8gB0r6SeywBj7m8JmivAnYt5EV46XkhvlGgaaHaJszbXsfGNG7ORvD27dSw XEqD0+gM0j7QUsiwIMrVe4niNJorq/Jo9jFaI= struct kevent my_kevent; int my_kq = -1; pid_t my_pid = 0; if (-1 == (my_kq = kqueue())) perror("trigger_error:kqueue"); printf("trigger:current_pid %d\n", getpid()); my_pid = fork(); if (-1 == my_pid) perror("trigger_error:fork"); else if (0 == my_pid) { perror("trigger_error:"); } else { printf("trigger:new child pid %d\n", my_pid); } my_kevent.ident = my_pid; /* identifier for this event */ my_kevent.filter = EVFILT_PROC; /* filter for event */ my_kevent.flags = EV_ADD; /* action flags for kqueue */ my_kevent.fflags = NOTE_FORK|NOTE_TRACK; /* filter flag value */ my_kevent.data = 0; /* filter data value */ my_kevent.udata = NULL; /* opaque user data identifier */ if (kevent(my_kq, &my_kevent, 0, NULL, 1, NULL) == -1) perror("trigger_error:kevent"); On Sun, Oct 19, 2008 at 3:57 AM, devmaillists <devmaillists@netdock.de> wrote:

Hello Terry, thanky very much, but I have to be compatible with 10.4. So fsevent is not an option for me (doc shows avail 10.5) You wrote: if you monitor specific files it works Yes I do, how does it work to get for a specific file a reference to the modifying process? Thanks Jürgen On 18.10.2008, at 20:02, Terry Lambert wrote:

On Oct 18, 2008, at 3:36 AM, devmaillists <devmaillists@netdock.de> wrote:

Dear List, I have the challenge to observe files for modification. The difficulty is to filter on the modifing processes. I need a way to get the PSN / PID of the modifing process / the process that triggered the event I get in: int event_count = kevent(kq, events_to_monitor, NUM_EVENT_SLOTS, event_data, num_files, &timeout);

You can't do that for arbitrary files using kevent; if you monitor specific files it works. If you want arbitrary files, you need to use fsevent in user space, or if you want to interpose the operation, kauth in a KEXT. If the latter, go to <http://developer.apple.com> and look for "kauthorama". -- Terry

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com

This email sent to openspecies@gmail.com

-- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com