{"id":24962826,"url":"https://github.com/charlie0129/iosnoopng","last_synced_at":"2026-04-29T17:40:25.071Z","repository":{"id":268245940,"uuid":"903754199","full_name":"charlie0129/iosnoopng","owner":"charlie0129","description":"Monitor disk activity on your Mac. Like iosnoop but with a Web GUI and Prometheus exporter, intended to be run as a daemon.","archived":false,"fork":false,"pushed_at":"2025-02-28T11:19:19.000Z","size":54,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-28T18:01:15.287Z","etag":null,"topics":["bsd","disk","macos","monitoring","tracing"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/charlie0129.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-15T13:35:00.000Z","updated_at":"2025-02-28T11:20:31.000Z","dependencies_parsed_at":"2025-02-28T12:24:26.865Z","dependency_job_id":"615bb2cc-0b40-4894-8f4e-2188a5c6af05","html_url":"https://github.com/charlie0129/iosnoopng","commit_stats":null,"previous_names":["charlie0129/iosnoopng"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charlie0129%2Fiosnoopng","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charlie0129%2Fiosnoopng/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charlie0129%2Fiosnoopng/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/charlie0129%2Fiosnoopng/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/charlie0129","download_url":"https://codeload.github.com/charlie0129/iosnoopng/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246112650,"owners_count":20725300,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bsd","disk","macos","monitoring","tracing"],"created_at":"2025-02-03T09:23:20.970Z","updated_at":"2026-04-29T17:40:25.042Z","avatar_url":"https://github.com/charlie0129.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# iosnoopng\n\nMonitor disk activity on your Mac. Like iosnoop but with a Web GUI, intended to be run as a daemon.\n\nHow is it different from the Disk tab of Activity Monitor? Activity Monitor can only show process that are currently running. However, iosnoopng can collect metrics from **transient processes** that are not shown in Activity Monitor (i.e. process that is not long-running, like your C compilers). It can also show the read and write bytes of each process to each file. It also has a Prometheus metrics endpoint so you can scrape the data using Prometheus and visualize it in Grafana.\n\n## Screenshots\n\nYou can view the total write and read bytes of each process.\n\n\u003cimg width=\"998\" alt=\"Total\" src=\"https://github.com/user-attachments/assets/ff53ac2a-3cb0-4fef-9343-19878a12b0f3\" /\u003e\n\nAnd the read and write bytes of each process to each file.\n\n\u003cimg width=\"998\" alt=\"Process\" src=\"https://github.com/user-attachments/assets/636eb391-af80-4105-ad0b-7d111269a86a\" /\u003e\n\nOr use Grafana to visualize results:\n\n\u003cimg width=\"1627\" alt=\"image\" src=\"https://github.com/user-attachments/assets/40d91a59-7d3b-414c-9450-bbfa55e88c26\" /\u003e\n\n## Build\n\nMake sure you have Node.js and Go installed.\n\n```bash\nnpm i\nmake\n```\n\n## Prerequisites (macOS)\n\nYou must disable SIP (System Integrity Protection) by booting into recovery mode and running `csrutil disable`. This is because iosnoopng uses dtrace, which requires SIP to be disabled.\n\n## Usage (macOS)\n\n\u003e [!WARNING]\n\u003e **Make sure your Mac has NOT slept since last boot**, otherwise you will almost certainly have a system freeze. If you are not sure, reboot your Mac now or save your work and be prepared for a system freeze if it happens.\n\u003e\n\u003e This tool uses dtrace internally. Due to an issue the darwin kernel, if your Mac has slept since the last boot, running dtrace may cause a system freeze. This is an issue with the darwin kernel and I have no control over it. See [this](https://forums.developer.apple.com/forums/thread/735939) .\n\u003e\n\n```bash\nsudo ./iosnoopng -d\n```\n\nBy default, the server will listen on `http://localhost:8092`. You can use launchd or other tools like PM2 to run this as a daemon.\n\n```\nUsage of ./iosnoopng:\n  -a string\n    \tListen address (default \"127.0.0.1:8092\")\n  -d\tDeduplicate launchd processes. Since launchd writes on behalf of other processes if the same file is written by another process it will be counted twice. This option removes the duplicated entries from launchd.\n  -f string\n    \tLoad previously saved process stat file as startpoint\n  -l string\n    \tLog level (default \"info\")\n  -n\tDo not run dtrace, only start the HTTP server\n  -o string\n    \tSave raw dtrace output to a file\n  -r\tReplay previous log file before collecting new data\n  -s int\n    \tOnly merge entries that are not updated more than this number of seconds. (default 3600)\n  -t int\n    \tMerge R/W smaller than this number of bytes into a single entry. This is useful for processes that write to many small files to save memory and make the output more readable. (default 33554432)\n```\n\n\u003e [!WARNING]\n\u003e Before quitting iosnoopng, **make sure your Mac have NOT slept**, due to the same reason mentioned above. If your Mac has not slept, you can safely quit iosnoopng (for example, by ^C). However, if your Mac has slept, quitting iosnoopng may cause a system freeze. Either let iosnoopng running or save your work and **force** reboot your Mac (yes, normal reboot won't work, you have to press and hold the power button to force reboot).\n\n## Extra Considerations\n\n- Since iosnoopng records paths of files, its memory usage may grow over time. However, it should not be a problem for most users because iosnoopng has small-files-merging enabled by default. So lots of small files will be merged into one entry to save memory.\n- The process list will continue to grow because it keeps the RW data of every process ever launched. If you have a lot of processes that *have distinct names* and you run iosnoopng for a long time (like over a month), the memory usage may grow. Currently, you can restart iosnoopng to clear the process list. Or file an issue if you need an HTTP API to clear the process list without restarting iosnoopng and I will add it.\n- The full path is not reported on macOS (only part of it). You will see every file starting with `/` even if the file is not there. This is a limitation of dtrace on macOS. For example, if you see a file `/idindex/IdIndex_inputs_i`, it is not in the root directory. If you need to find its full path, you can use `find . -name IdIndex_inputs_i` to find it. In my case, it is `$HOME/Library/Caches/JetBrains/GoLand2024.2/index/idindex/IdIndex.storage_i`\n\n## Scraping Metrics with Prometheus and Visualizing with Grafana\n\nYou can scrape the metrics with Prometheus. Here is an example configuration:\n\n```yaml\nscrape_configs:\n  - job_name: \"iosnoopng\"\n    static_configs:\n      - targets: [\"127.0.0.1:8092\"]\n```\nYou will see metrics names like `iosnoopng_read_bytes_total` and `iosnoopng_written_bytes_total`.\n\nOnce you have Grafana and Prometheus set up, you can import the example dashboard from `dashboards/process-read-and-writes.json`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcharlie0129%2Fiosnoopng","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcharlie0129%2Fiosnoopng","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcharlie0129%2Fiosnoopng/lists"}