Giters

nowsecure / fsmon

monitor filesystem on iOS / OS X / Android / FirefoxOS / Linux

Home Page:https://www.nowsecure.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

fsevapi backend on macOS is buggy

UNIVAC-Colonel-Panic opened this issue · comments

commented

Hi,

I wanted to use fsmon-osx to monitor a long, Finder file move operation, something I estimated would take about 20 minutes. In case it matters, I was copying between two mounted .dmg "Case-sensitive HFS+" filesystems. Let's call these /Volumes/Source and /Volumes/Target.

In Finder, I selected the files to copy in /Volumes/Source, then did a paste operation into /Volumes/Target.

Meanwhile, because of issue #44 I downloaded and compiled fsmon-osx from source. No errors during make. I then launched it with:

$ sudo ./fsmon-osx /Volumes/Target

Unfortunately, in the time it took me to download, compile and launch fsmon-osx, the Finder paste operation completed sooner than I expected; fsmon-osx didn't show any activity. Not a big deal as I had more files to move so I just left fsmon-osx running.

With the Finder paste operation successfully completed, I made the Finder window for /Volumes/Source active. It still had the files selected, so I proceeded to have Finder move them to Trash.

This is where it gets weird. Even though fsmon-osx was pointed to /Volumes/Target, as soon as Finder started moving files to Trash, fsmon-osx started showing hundreds of lines like this:

Invalid length in fsevents data packet (14, 14)
Invalid length in fsevents data packet (14, 14)
Invalid length in fsevents data packet (14, 142)
ERROR unknown type 12147
ERROR unknown type 11825
ERROR unknown type 2304
ERROR unknown type 64768
ERROR unknown type 2048
ERROR unknown type 5120
ERROR unknown type 30060
ERROR unknown type 29268
ERROR unknown type 25454
ERROR unknown type 28461
ERROR unknown type 41343
Overflow detected and corrected (310, 306)
Invalid length in fsevents data packet (14, 14)
Invalid length in fsevents data packet (14, 281)
ERROR unknown type 12147
ERROR unknown type 11825
ERROR unknown type 2304
ERROR unknown type 26368
ERROR unknown type 2048
ERROR unknown type 5120
ERROR unknown type 30060
ERROR unknown type 29268
ERROR unknown type 25454
(snip)

My questions:

  1. Why would fsmon-osx start showing activity on the move to trash action for /Volumes/Source, when I told it to monitor /Volumes/Target?

  2. What do the errors above mean? "Error unknown type...", "Invalid length..." and "Overflow detected..." ?

commented

UPDATE: The move to trash completed. I'd already made sure that there was nothing in /Volumes/Target/.Trash, only in /Volumes/Source/.Trash (as expected).

fsmon-osx was still running after I did my OP.

  1. Next, I emptied Trash. This got an immediate reaction from fsmon-osx -- it showed the same errors ("Error unknown type...", "Invalid length..." and "Overflow detected...") but there were only about 20 this time vs. hundreds.

  2. fsmon-osx aborted on its own with "read: Undefined error: 0":

     (snip)
     ERROR unknown type 122
     Invalid length in fsevents data packet (14, 143)
     Invalid length in fsevents data packet (14, 94)
     ERROR unknown type 12133
     ERROR unknown type 29811
     ERROR unknown type 122
     Invalid length in fsevents data packet (14, 44)
     Invalid length in fsevents data packet (14, 14)
     read: Undefined error: 0
     $
commented

This is probably because of the devfs backend which is not properly implemented and sometimes it starts parsing trash from the device that it is not parsing it well.

i've changed the default backend to be the fsdevapi. Let me know if it works better for you too. You can pick a different backend (if you are lazy to git pull+make) with -B.

btw fsmon-osx is now named fsmon-macos

commented

Please try again with latest 1.8.0, the devfs backend must be fixed but it's no longer the default so it's not that problematic now. i'll keep this issue opened with a fixed title for reference.