6 Replies Latest reply: Oct 21, 2011 12:56 PM by etresoft
Tod Kuykendall Level 4 Level 4 (2,270 points)

Am I missing any RunningApplications-like function for non-windowed processes like Unix executables? To start with I'd settle for processes in user-space but would ultimately like to list processes like Activity Monitor does. Even comparing RunningApplications results to user space Activity Monitor results will show the difference.

 

As far as I can tell you need to go all the way down to kauth and kernel space to watch for non-windowed processes being launched. Is there somethig in-between I'm missing? A notification device about launching apps would be perfect if it cover all processes.

 

Thanks,

=Tod

  • Tod Kuykendall Level 4 Level 4 (2,270 points)

    Bumping my own question with some follow-up information. The Carbon Process Manager doesn't explicitly say it only handles windowed apps so took a frightening flashback dive into Carbon and tested it and it returns the same results as RunningAppliciations.

     

    I also dumped the libraries that Activity Monitor is linked against and nothing too interesting came out of that. The only private libraries are /PrivateFrameworks/GraphKit and /PrivateFrameworks/CrashReporterSupport. I'm 99% sure that Graphkit is the pie-chart and line drawing framework so I'm ignoring that one. I guess I can see where a Crash Reporter framework might have deeper process information than is publically available but I'm not sure where that leaves me to go. There are always options like parsing output from top and ps but that strikes me as miserable option doomed to disappointing results.

     

    Still looking for suggestions,

    =Tod

  • etresoft Level 7 Level 7 (25,645 points)

    Try looking at the source to the /proc MacFUSE file system.

  • Tod Kuykendall Level 4 Level 4 (2,270 points)

    Thanks, etresoft, helpful as always. It seems that procfs gives me much of what I was looking for but it is built on MacFuse (which has its own kext I believe) and and requires pcre etc and so is pretty complicated to think about deployment. If I'm going to do what I originally wanted it looks like I need to use kauth anyway and maybe parse the output of sysctl as well. I was really hoping to stay away from sysctl and out of kernel space but it doesn't seem to any other way to do what I was hoping to.

     

    Guess I need to decide if it's worth the effort,

    =Tod

  • etresoft Level 7 Level 7 (25,645 points)

    I didn't mean to use MacFUSE, I just meant to look at the code for the Mac version of procfs. If there is a mechanism to get notification of process launch, it would be in there. I'm not certain it is in there. I think that the procfs actions are called as needed.

     

    I think kqueue may be able to do what you want. Look at the EVFILT_PROC filter. You may have to watch a number of processes - perhaps all of them. But that would tell you any time you get a fork and whenever a process is reaped.

  • Tod Kuykendall Level 4 Level 4 (2,270 points)

    I think kqueue may be able to do what you want. Look at the EVFILT_PROC filter. You may have to watch a number of processes - perhaps all of them. But that would tell you any time you get a fork and whenever a process is reaped.

     

    I looked at kqueue at it does what I want but you need to register it on a by process/file basis which is great for a very specific set of things but not for overall system watching. (I also looked at fsevents but it is designed as a post-event notification system.) While NSWorkspace has the usual Cocoa model notifcation willlaunchApp, didlaunchApp, etc it seems that you need to get the kernel to watch the launch lifecycle of non-windowed functions.

     

    I actually did manage to get a comprehensive list of running apps out of parsing sysctl output with much less trouble than I expected. So far I have managed to get the pid, uid and abbreviated processname and the list seems to match the Activity Monitor list - at least at this testing printf stage. Getting the username from uid should be trivial and the full file name is doable it just requires some struct length and offset math. I'd like the launch path information but I can live without it for monitoring purposes if I can't figure out how to get it.

     

    This means that the monitoring part of the running system seems relatively straight forward - wrapping the call in an NSTimer and watching for changes in the returned results. But the watching of the actual starting and stopping of all processes remains some deeper work.

     

    Thanks for all the suggestions,

    =Tod

  • etresoft Level 7 Level 7 (25,645 points)

    Why can't you use kqueue to watch each running process? There should usually be only 1-2 hundred of them. That could be less resource intensive than a timer.