Mac: Write scripts\guide for capturing file system events when problems occur

On Windows we can ask users to run procmon to capture the I/O that’s happening on their system when errors occur.

It sounds like dtrace might be able to get us something similar on Mac, but work needs to be done to determine how we should configure\run dtrace to get the information we’re interested in.

The issue encompasses:

• Researching dtrace and determining what useful information can be captured and how to capture it
• Creating script(s) to start\stop dtrace with the options we need
• Writing up a guide on how to collect\analyze data from dtrace

[wilbaker]

@pmj, I think there’s actually one more item to call out as being within the scope of this task:

• If the amount of useful information we can get from dtrace depends on whether SIP is enabled\disabled, write scripts that can take advantage of the extra information available when SIP is disabled. This can be either a separate script, or as an option for a single script (that can run in both SIP modes). This will be helpful for diagnosing issues that we can reproduce on machines where SIP is disabled.

/ cc: @jrbriggs, @nickgra

[jrbriggs]

Thanks @pmj. I’m going to consider this issue closed now, and if we find that we want more data when investigating support issues we’ll create other issues to track that work.