Ways to monitor hard-drive activity and usage in OS X

http://reviews.cnet.com/8301-13727_7-20061984-263.html

fs_usage fseventer

fseventer for Mac

fs_usage fslogger

There are several ways to figure out what files are being accessed by a specific application in OS X, which can help when troubleshooting various settings and system features.

by Topher Kessler

Every now and then it can be useful to track how a program or process is accessing the hard drive. There are times when troubleshooting when you may want to track what files get changed when application settings are adjusted, or which files are accessed when you load a particular feature. Apple provides the Activity Monitor utility that will show you the overall input and output rates of the hard drive, but this overview does not specify the files that are being accessed.

While there are numerous ways to monitor hard-drive activity and usage in OS X, I've found that the following three options seem to work very well for identifying specific files that are updated by program activity.

Finder
Oddly enough, the Finder or another filesystem browser can be exceptionally useful in isolating files that are updated by programs. When a file is edited its modification date will change, so if you suspect a particular file holds a specific system setting then you can go to that folder in the Finder and sort items in list view by their creation dates.

After doing this, keep the Finder window open and monitor the creation date values when toggling your setting of interest. If a file in the present folder is altered by the settings, then you should see it go to the top of the list and be updated to reflect the new creation date. Sometimes when doing this it helps to wait at least a minute between invoking setting changes so you can clearly see a time change in the file's modification date (the Finder by default only shows date changes to the nearest minute).

While the Finder is a useful tool, it is fairly limited in that it will only show you when a file has been changed and not when it's accessed, and it will also only do so for the files in a single directory. You can sometimes get creative and lucky by using smart searches and other Finder features to expand these limitations, but overall it is still a rather crude approach.

Applications
Instead of using the Finder, a few third-party applications are available that can really help determine when files are being accessed. The one I use the most, called Fseventer, builds a graphical filesystem tree of the files and folders that have been accessed after a given point in time. The utility is fast and shows all filesystem events, including those in hidden files and even temporary files.

Fseventer will show numerous attributes about the files that have been changed in a given monitoring session.

To use the utility, just open it and then go to the application or setting you wish to test. Click the Play/Go button at the top of Fseventer's window and the program will start monitoring filesystem events. Then perform the action you are interested in and watch the Fseventer window to see what files are accessed. After this, to prevent Fseventer from showing activity from other processes, go back and click the Play/Go button again.

While Fseventer is an exceptionally useful program, it does rather blindly target all filesystem events, so if in the middle of your monitoring session the system performs a MobileMe synchronization or other similar action then you may see the window fill up with events that are not associated with the events you are monitoring. Therefore it may be useful to repeat monitoring sessions several times with Fseventer to confirm that the files being accessed are correct.

Terminal
Finally, in addition to the Finder and Fseventer, you can use the Terminal command "fs_usage" to show filesystem events. This uses the same underlying technology as Fseventer, but can be used to isolate the filesystem events that were invoked by a certain process name or id. To use the fs_usage command, you will need to do the following:

The Terminal tool 'fs_usage' will output all filesystem activity in a list, but the tool's options can be used to better isolate activity from various programs.

1. Open the Terminal utility
2. Type the following into the Terminal:
   sudo fs_usage
3. Optionally type an additional space followed by the name of the application you are monitoring. In the case of iCal, for example, the command would look like the following:
   sudo fs_usage iCal

After the command is typed, press Enter and supply your password (this must be done from an Admin account) and the command will output to the Terminal window each time the program performs a filesystem access operation. This is a basic use of the command, but if you read themanual page for the command you can supply flags and options to further specify the type of events the command will monitor. When you want to quit the process in the Terminal window, just press Control-C.

--------------------------------------------------------------------

http://hints.macworld.com/article.php?story=20091223115101622

Find files created or modified by an installer  Jan 05, '10 07:30:00AM • Contributed by: tempel Do you like to know which files and folders get created or modified when you install a new application? I can suggest two different solutions: Either use a tool to track all file system changes, or use a tool that searches the disk by creation/modification dates. [robg adds: This hint includes information about using a free program, Find Any File, as one way to track file system changes. The author of this hint (Thomas Tempelmann) is the author of that application. However, because there's good information here in the hint, and because the app itself is free and seems to work well, I felt it was worth sharing. Read on for the discussion...] Logging tools First the "pro" method: Use a file system logging tool to trace all file operations during a period of time. The problem with these tools, though, is that you might see much more information than you want. Sorting out what's relevant may need some experience and/or patience. For Terminal-savvy users, the tools of trade are: fs_usage and fslogger. I'll not go into detail here, as they require some reading, and there are man pages available. There's also fseventer, which provides a graphical user interface to fslogger. However, it doesn't offer convenient filters, so you'll usually get much more information than you seek. Regardless of the tool used, the workflow is as follows: Start the logging tool Install the software Stop/pause the logging tool and analyze its output. Searching for modifications afterwards Another alternative is to use my program, Find Any File (FAF), which allows you to search for recent file and folder changes on your disk. Again, this might show you more items than just those of an install process, but the hierarchical view in FAF's results window should make it easy to see which folders and changes are related to the installation. The workflow is as follows: Note the time when you start the application installation. Once the installation has finished, launch Find Any File, and change its search criteria to something like: Modification Date -- is within the past -- X minutes, replacing the "X" with the amount of time that passed since you started the installation. Hold down the Option key, which changes the Find button to Find All, then click the Find All button, which will relaunch FAF in root mode (and ask for your admin password) and start searching all areas of your hard drive. Once you see the results window, switch to the hierarchical view (Command-2) to see which folders have changed items. Repeat the search process for files with a recent Creation Date Note: The are many other find tools similar to Find Any File, but FAF has the ability to search in root user mode, making it possible to find even such files that may be protected or hidden to the "normal" user. Conclusion None of the above options are perfect. The file system logging technique is safer than using a search tool (which still can be fooled if an installer resets creation dates of files and folders). I sometimes like to know what gets installed in my system, especially if it's an installer that asks me for my admin password. Usually, the "find" technique is sufficient, but if you really need to know every detail, go the logging route. I think the best way to see which files get modified or installed by an app or its installer is to develop a special application which is based on fslogger or fs_usage, and which pays attention only to modifications invoked by the targeted app or its installer. A unix whiz may even be able to get this working just with fs_usage (it has quite a few helpful filters for this), but I imagine something with an easy-to-use UI. Any takers?

How to reset Mac OS X app trials

http://web.archive.org/web/20091004032150/http://bluman.wordpress.com/2009/09/20/just-a-little-bit-longer/


sudo fs_usage grep applicationName grep open

Just a little bit longer

September 20, 2009Leave a commentGo to comments

There are many commercial Mac applications out there, which offer a free demo for download. Often you can use the full featured program for a limited time or a limited number of tasks. If you want to use the software after the trial period, you have to buy a licence for it. Sometimes I want to test these applications just a little bit longer, so I looked for a way to extend the trail period.

Since Mac OS doesn’t use something similar to the registry in Windows, the information about how many days are left for testing has to be stored somewhere in a file. If you knew the location of this file, you could just delete it and the trail period will start from the beginning. Of course, software developers don’t want you to do that. Therefore, these files are normally in locations you wouldn’t look and have meaningless names.

Fortunately, there is a tool which can help called fs_usage. This command line tool reports filesystem activity in real-time. Since there normally is a lot of activity going on, it is useful to filter out entries coming from the application of interest by grepping. You will also get information about what kind of activity is performed, allowing further filtering. With the following command you should be able to find the file of interest:

sudo fs_usage | grep applicationName | grep open

I deleted the file and was able to test the software further on, before making the decision to pay for it. If you want to test the application even longer without having to repeatedly deleting the file, you can try to change the file permissions (with chmod) such that the file is not writable anymore. Of course, this will only work if the number of uses are counted there, not if the date of first program start is stored. Have fun!

Tags:Mac, Software, Tutorial

Uninstalling Applications in Mac OS X / To manually remove an application and all associated files

http://guides.macrumors.com/Uninstalling_Applications_in_Mac_OS_X

Uninstalling applications in Mac OS X is very different than uninstalling in a Microsoft Windows environment because Mac OS X has nothing like the Windows Registry. While most Windows programs include an uninstaller that can be run through using the Add/Remove Programs control panel, no such feature exists in Mac OS X and so most users simply move application bundles (see below) to the Trash. However, often times there is more to uninstalling than a simple drag-and-drop to the trash. This article will guide you on how to fully uninstall applications.

Application Bundles

Control-click or RIght-click on any application to see if it is a bundle

Most Mac OS X applications (anything that ends in .app), like Safari and iTunes, are bundles. The application icon you see in Finder (typically the Applications Folder) is usually a special folder itself, made to appear as a single double-clickable file. These "folders" contain all, or at least most, of the files needed to run the application, ie they are self-contained. This means that to uninstall these applications, you only have to drag them to the Trash. If you control-click (or right-click) on an Application icon, and you see "Show Package Contents", then it is a bundle.

[edit]

Additional Files

Applications will leave behind preference files, and sometimes application support files, neither of which are stored in application bundles. Preference files can be safely deleted, but they usually take up negligible disk space — and, if you decide to reinstall the application again later, keeping the preference file means your settings will still be there. They are stored in the Preferences folder within your user's Library folder (~/Library/Preferences), or may also be stored in the system-wide Library located at the root of the system volume (/Library/Preferences/).

Application support files can take up anywhere from a few kilobytes to several gigabytes of space, depending on the application installed. Examples of applications that have large support files are multimedia programs such as Garageband and DVD Studio Pro. They are located in the Application Support folder within your user's Library folder, or in "/Library/Application Support/".

To remove an application's icon from the dock make sure that the program is not running at the time, then simply drag the icon off of the dock and let go. There will be a puff of smoke animation and the icon will be gone. This will only remove the dock icon/shortcut, and will not touch the application itself or any of its support files.

[edit]

Using Finder to remove Application Bundles and Additional Files

Using Finder to remove applications and all preference files

Adapted from a forum post by GGJstudios

To manually remove an application and all associated files:

• Launch Activity Monitor and change "My Processes" at the top to "All Processes", then make sure the app you want to remove is not running. If it is, quit the process before proceeding.
• Launch Finder and search for the app name (hopefully unique, such as Skype)
• You can narrow the search to specific folders or search your whole Mac
• Searching "File Name" vs "Contents" usually provides better results.
• Click the + button below the search term to add criteria
• Click the search criteria drop-down and select "Other...", then "System files"
• Click the "don't include" and change to "include"
• Sort by name, kind, date, etc. to identify components of the app, such as folders, .plist files, cache files. etc.
• Delete all files and folders related to the app.
• Don't empty your Trash until you've determined that everything is working OK, in case you need to restore something you deleted by accident.
• A reboot might be necessary to completely remove some apps.

[edit]

Applications with Installers/Uninstallers

If you ran an installer to install an application, you may wish to try running the installation program again to see if an uninstall option is available at any point during installation (many times in a drop-down menu). Check the installation CD or disk image for the original installer file. Some vendors have included simple Perl scripts that will run in the command line to uninstall applications, and may be named "uninstaller.pl".

[edit]

Third Party Uninstallers

Be aware that third party uninstallers, including those listed below, do not completely remove all files/folders associated with apps. Many will remove small files, such as .plist files, but leave behind much larger files. For more information, read this. For complete removal of all files/folders associated with uninstalled apps, use Finder and the manual method described above.

Caution is advised when using any automated method of deleting files, as such methods could result in files being deleted that you didn't want deleted. Many have reported problems caused by the use of apps like CleanMyMac and MacKeeper, so avoidance of these apps altogether may be wise.

Third party uninstallers exist which will search for these preference files for you, such as AppCleaner, AppTrap, AppZapper, CleanApp and TrashMe, but these apps will not remove all components of installed apps.

To manually remove an application and all associated files:

http://forums.macrumors.com/showpost.php?p=11171082&postcount=16

To manually remove an application and all associated files:

1. Launch Activity Monitor and change "My Processes" at the top to "All Processes", then make sure the app you want to remove is not running. If it is, quit the process before proceeding.
   
2. Launch Finder (see image below) and search your entire hard drive for the app name (hopefully unique, such as Skype)
   
3. In Finder, select View > "as List", if you haven't already done so. Do not use "as Icons" for this procedure.
   
4. You can narrow the search to specific folders or search your whole Mac, which is preferred
   
5. In Snow Leopard and earlier, click "File Name" instead of "Contents" for better results.
   In Lion and later, click the + button below the search term, then select "Name" "Contains" and enter the app name. (see image)

   

6. Click the + button below the search term to add criteria, then click the search criteria drop-down and select "Other...", then "System files"
   
7. Click the "aren't included" and change to "are included"
   
8. Sort by name, kind, date, etc. to identify components of the app, such as folders, .plist files, cache files. etc.
   
9. Delete all files and folders related to the app.
   
10. Don't empty your Trash until you've determined that everything is working OK, in case you need to restore something you deleted by accident.
    
11. A reboot might be necessary to completely remove some apps.

Click here to see a video demonstration of this procedure, created by simsaladimbamba.

[edit]

Apple OS X and Time Machine Tips

http://pondini.org/TM/Home.html

Uninstall Oracle Java 7

Uninstalling the JRE

To uninstall the JRE, you must have Administrator privileges and execute the remove commands either as root or by using the sudo(8) tool.

Remove one directory and one file (a symlink), as follows:

• Navigate to /Library/Internet Plug-Ins and remove the JavaAppletPlugin.plugin directory.
• Navigate to /Library/PreferencePanes and remove JavaControlPanel.prefpane.

Do not attempt to uninstall Java by removing the Java tools from /usr/bin. This directory is part of the system software and any changes will be reset by Apple the next time you perform an update of the OS.

How do I uninstall Java 7 and restore Java 6 for my Mac?

---

This article applies to:

• Platform(s): Macintosh OS X
• Java version(s): 7.0

---

Uninstall Oracle Java 7

Following the steps listed will uninstall Oracle Java 7 from your system.
Note: To uninstall Java 7, you must have Administrator privileges.

1. Click on the Finder icon located in your dock
2. Click on Applications tab on the sidebar
3. In the Search box enter JavaAppletPlugin.plugin
4. This will find the JavaAppletPlugin.plugin file
5. Right click on JavaAppletPlugin.plugin and select Move to Trash

Restore Apple's Java after uninstalling Oracle Java 7

If you find an issue using Java 7 and would like to continue using Apple's Java on your Mac, you will need to first uninstall Java 7, then restore Apple's Java
Note: To restore Apple's Java, you must have Administrator privileges and execute the command either as root or by using sudo.

1. Click on the Finder icon located in your dock
2. Click on Applications tab on sidebar
3. Click on the Utilities folder
4. Double-click on the Terminal icon
5. In the Terminal window Copy and Paste the command below:
   sudo ln -s /System/Library/Java/Support/CoreDeploy.bundle/Contents/JavaAppletPlugin.plugin /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin

---

MORE TECHNICAL INFORMATION 

Alternative method to Uninstall Oracle Java 7 using the Terminal

This is an alternative method for uninstalling Java 7 for advanced users familiar with entering commands on Terminal window.
Following the steps listed will uninstall Oracle Java 7 from your system.
Note: To uninstall Java 7, you must have Administrator privileges and execute the remove command either as root or by using the sudo.

1. Click on the Finder icon located in your dock
2. Click on Applications tab on sidebar
3. Click on the Utilities folder
4. Double-click on the Terminal icon
5. In the Terminal window Copy and Paste the command below:
   sudo rm -fr /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin

http://docs.oracle.com/javase/7/docs/webnotes/install/mac/mac-jre.html


http://java.com/en/download/help/mac_uninstall_java.xml

VMware Virtual Disk Manager

http://www.vmware.com/pdf/VirtualDiskManager.pdf

Repairing virtual disks in Fusion