Sloth – A Mac app that shows all open files, directories, sockets, etc.

by kruuuder • 3 years ago

787 124 3 years ago

johtso• 3 years ago

I wish there was a way to see which files were being actively written to sorted by amount of data written. Various times I've seen my disk space rapidly dwindling with no way of know what file was responsible..

pram• 3 years ago

Activity monitor shows what’s being written and the accumulative R/W by process. Wouldn’t be too hard to look at lsof and figure it out.

miles2• 3 years ago

FSMonitor[0] is similar to the old FileMon[1] but for macOS.

In the default tree view, as new data is written, the entries are highlighted and sort of throb, so it's easy to track what's going on.

[0] https://fsmonitor.com/

[1] https://learn.microsoft.com/en-us/sysinternals/downloads/fil...

yehaaa• 3 years ago

Check out rwsnoop, included in macOS. It use Dtrace to trace the read/write syscalls. You need to turn off SIP for Dtrace though afaik.

brigandish• 3 years ago

Happened to me this morning, something filled up my drive in minutes. I used dust[1] to look for large files while it was happening but knowing what was doing it would've been a big help.

[1] https://github.com/bootandy/dust

krono• 3 years ago

If you'd rather spend some of your time than your money on this, you can use the built-in fs_usage terminal command and filter its output (e.g. with grep). Works even with SIP enabled, but will then obviously only return information that SIP doesn't cover.

More info:

  man fs_usage

Example showing pathname-only events but otherwise unfiltered:

  sudo fs_usage -ew -f pathname

Jakob• 3 years ago

I used this incantation in the past to get the hottest file paths

  $ sudo fs_usage -w -t 5 -f filesys | tee fs_usage.log | egrep -o '(/.+?) {3}' | sed -e 's/\/dev\/disk[^ ]+  //' | sort | uniq -c | sort -nr

From https://www.jakobstoeck.de/2017/ramdisk-for-faster-applicati...

jalcazar• 3 years ago

iotop ?

sva_2• 3 years ago

On Linux, this can be done using BPF (Berkley Packet Filter). In fact there is a tool in BCC[0] called filetop, which lists reads/writes by process and file[1].

0. https://github.com/iovisor/bcc

1. https://github.com/iovisor/bcc/blob/master/tools/filetop.py

astrange2• 3 years ago

Not sure you can do that 100% of the time, since programs can write to unlinked files and I'm not sure those remember what their paths were.

vegasbrianc• 3 years ago

Cool app, is this essentially a visual representation of the ‘lsof’ command?

antegamisou• 3 years ago

This was my exact thought too. How is it any different from it?

dopidopHN• 3 years ago

It’s says on their page it’s a GUI for lsof.

karaterobot• 3 years ago

Nice GUI for lsof.

Yep!

bdcravens• 3 years ago

Name probably comes from rearranging the letters (slof)

techwizrd• 3 years ago

I believe you're correct according to the linked Github repo:

Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.

wellthisisgreat• 3 years ago

They should have rolled with “Slof” and use the “f” as a phonetic writing of “th”

1vuio0pswjnm7• 3 years ago

BSD userland has fstat. Arguably no need for lsof but I guess some people might prefer lsof.

matthewhartmans• 3 years ago

This is awesome! Well done OP!

evasb• 3 years ago

One things I envy about the macOS users is how obstinate they are to better macOS for free to Apple. While Linux users with the time tend to just be satisfied with the CLI tools and ignore GUI. At best, you would have a curses app to this.

macintux2• 3 years ago

That’s a rather backhanded compliment, but yes, when you use slick tools on a daily basis there’s a halo effect. Mac developers have, for decades now, taken pride in writing native applications that run well and look clean.

nerdponx2• 3 years ago

I suspect this also has to do with the presence of a native first-party GUI toolkit and app framework that deeply integrates with the rest of the system.

There are plenty of developers who also take pride in developing native applications on Linux that run well and look good, but from what little I know about GUI app dev, it's harder to do that in a way that runs well and looks good on the wide range of Linux-based systems that exist out there.

fatcat500• 3 years ago

No offense but the logo looks disgusting.

jonpurdy• 3 years ago

Posting a reply since there is validity to the terse comment.

I clicked out of curiosity and my trypophobia was definitely triggered. Probably due to the numerous “holes” around the edges of the sloth.

Those who don’t have trypophobia understandably would think it’s ridiculous. But as someone who feels it for whatever reason, it’s totally real.

graeme• 3 years ago

I don’t have trypophobia, but the logo reminds me of some sort of hideous alien slug

azangru• 3 years ago

Probably due to the numerous “holes” around the edges of the sloth.

Isn't it sort of the point? Since the app is showing you all the ports (i.e. "holes") that are open?

mdni007• 3 years ago

Definitely one of the ugliest looking logos I've seen in a long time

h0l0cube2• 3 years ago

Some constructive advice to the author, if they're lurking: "Good" logos economize on details to maximize impression and versatility. Use fewer and simpler shapes to communicate better. Or maybe let an AI tool have at it?

h0l0cube2• 3 years ago

Another note to the author if they see this. I don’t find the logo offensive like the sibling commenters. I love the creative process and wasted days making logos which other people found unpalatable. People have visceral responses to logos for better or worse, which is why logos have become so boring over time - it’s just safer. But I do not hate the sloth

qumpis• 3 years ago

Agreed. The style looks nice and idea clear. But the details make this look unsettling, like early versions of AI generated human faces, resulting in creepy output

imgabe• 3 years ago

Disgusting is harsh, but it does look weird. It makes me think of some kind of single-celled organism or maybe an upside down turkey head and neck.

ChickenNugger• 3 years ago

I thought it was a bloodworm at first: https://www.youtube.com/watch?v=o7aM5gU8mFY

Somebody needs Cayce Pollard (https://www.goodreads.com/en/book/show/22320) to have a look.

gre• 3 years ago

It reminds me of a white grub.

https://extension.entm.purdue.edu/fieldcropsipm/insects/corn....

makeitdouble• 3 years ago

Sharing the sentiment.

The logo looks competently drawn and is better at bigger scales where the details are clearer, but from a distance it caused me a visceral rejection reaction.

A sloth drawn with less fur detail would be simply cute, for instance: https://media.tenor.com/yypYI980ipUAAAAC/sloth-animal.gif

detrites• 3 years ago

Not sure if it still works, but on macOS previously you could Command-I (Info) on two files, click the icon in one info window (highlighting it), and copy-paste on the other.

Quick fix for ugly app icons.

verteu• 3 years ago

As a simple alternative, I had good results using Craiyon with prompts like "cute sloth, company logo, vector art, simple".

mcoliver• 3 years ago

Very cool. One of the things I would love to be able to do is to track all file reads and writes that traverse a network connection. You can kind of do this using a combination of fs_usage/iftop/lsof in the moment but it's rough. Can Sloth or something like little snitch do it?

Sometimes I'll see my network spike via menumeters but I have no idea what caused it. Was it Google drive syncing something? Something else? What files were accessed?

danielvaughn• 3 years ago

This is one of those no-brainer features that really should ship by default with any machine.

As it happens, there are GUIs that kinda do this, though not intentionally. Charles Proxy comes close, though the interface was a bit rough the last time I used it (2016).

cmason• 3 years ago

Does istat menus not show this? Is it just not detailed enough? I guess some stuff like backups show up under “kernel”…

janpio• 3 years ago

Charles Web Proxy will still feel a bit like 2016, not that much changed unter last few years. But it still works and does all the things it needs.

Etheryte• 3 years ago

Not quite what you were describing, but perhaps Netiquette [0] would be of help here?

[0] https://objective-see.org/products/netiquette.html

Kukumber• 3 years ago

Nice desktop UI, simple yet effective!

29athrowaway4• 3 years ago

lsof provides this information

amelius• 3 years ago

Yeah, but I always forget the relevant flags.

29athrowaway4• 3 years ago

man lsof

nkrisc• 3 years ago

Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.

simonw2• 3 years ago

Opening this and then searching for "\.db$" reveals all of the processes that are (probably) using SQLite, which is fun for finding things you can poke around in.

Try "\.sqlite" too.

This is fun:

    brew install datasette
    datasette ~/Library/Calendars/Calendar.sqlitedb

graderjs• 3 years ago

I think because Core data is SQL lite?

simonw2• 3 years ago

Yup - as a result, there's usually a TON of interesting SQLite files on any Mac (and iPhone too if you can get at them).

JKCalhoun• 3 years ago

I believe you can choose the kind of store you want for Core Data. (SQL is probably the most popular though.)

CSDude• 3 years ago

Example for Photos.app https://medium.com/@mustafaakin/how-to-organize-your-messy-a...

nerdponx2• 3 years ago

You can also use this for things like exporting your notes and imessage history to plain text.

Dachande663• 3 years ago

Probably find *.etilqs files as well (believe Firefox uses that). It’s sqlite backwards to avoid rampant google hordes descending on the developer.

saltypal• 3 years ago

Oh wow, thank you!

I'd been poking through them with plain old `sqlite3` and then deserializing all the plist data with something like `pbpaste | xxd -r -p > foo.plist` for examination, but had no idea datasette existed and https://datasette.io/plugins/datasette-bplist#user-content-t... seems like the ticket for browsing these.

For others: all the Caches.db files are the per-process HTTP cache that NSURLRequest/NSURLSession keeps, so if you peek at it you can see (partially) a history of network requests that process has made. Most of them seem to pull feature flag configuration from https://bag.itunes.apple.com/bag.xml, but others do more interesting things.

chrisledet• 3 years ago

Looks good from what I see in the screenshots. I'd like to find something similar for Windows.

kritr• 3 years ago

Sysinternal’s Process Explorer might be what you’re looking for. https://learn.microsoft.com/en-us/sysinternals/downloads/pro...

miles2• 3 years ago

Process Monitor ("an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity") may be the closer parallel:

https://learn.microsoft.com/en-us/sysinternals/downloads/pro...

grishka• 3 years ago

The thing you want to google is "sysinternals".

DominoTree• 3 years ago

System Informer (formerly Process Hacker) might also have what you're looking for

https://systeminformer.sourceforge.io/

rejectfinite• 3 years ago

Not similar, but look into the Microsoft Powertoys tool for other cool utilities on Windows. There is a Spotlight search tool, OCR text, Zones etc.

As others have said, Sysinternals Process Explorer and Process Monitor.

https://helpdeskgeek.com/windows-10/how-to-use-process-monit...

buzzier• 3 years ago

Press Windows+R to show Run, input resmon.exe and hit OK.

boopmaster• 3 years ago

Love this, reminds me of the BeOS process controller that permitted killing individual threads IIRC. useful when you need to unfreeze an app without losing your work in that app!

Ref image here:

http://www.lucidelectricdreams.com/2010/10/haiku-remember-wh...

joshspankit2• 3 years ago

All this time, and BeOS still schools modern operating systems

guessmyname2• 3 years ago

They also develop an app for that I have used for years to open Burp Suite on Mac called Platypus — https://github.com/sveinbjornt/Platypus

Platypus allows you to create a Mac [dot]app wrapper around any type of scripts.

djhn2• 3 years ago

Love Platypus, but can I ask how and why do you use burp suite through it instead of installing burp suite on macos normally?

guessmyname2• 3 years ago

Burp Suite does not create a [dot]app folder, so every time I want to start it I have to open the Terminal and run "java -jar /path/to/burpsuite.jar", which is not a big problem but I very much prefer to press Cmd+Space, quickly type "burp" and then press the Return key to start the Platypus wrapper.

arunc• 3 years ago

Reminds me of the awesome Gnome2 widgets that were so simple and elegant.

bb88• 3 years ago

lsof for linux was awesome when I discovered that.

ridiculous_fish• 3 years ago

This is wonderful! Thank you for writing this.

hparadiz• 3 years ago

Something like this should be a standard tool in every operating system no different from a task manager application.

wingi• 3 years ago

lsof ?

alchemist1e9• 3 years ago

Exactly.

lsof | fzf

neilalexander• 3 years ago

The built-in Activity Monitor in macOS also has the ability to show open descriptors for a process. Double-click a process and go into the "Open Files and Ports" tab.

quenix• 3 years ago

That leaves lots to be desired

3142• 3 years ago

I guess that I'm not the target audience for this - I like grep as UI on top of lsof, maybe in combination with less, and I've always found it fast and easy to use.

For people that are the target audience of this, I'm curious - what do you like about putting the information into a gui and using a mouse instead of a keyboard?

kruuuder• 3 years ago

what do you like about putting the information into a gui and using a mouse instead of a keyboard?

I don't have to remember anything to use it, I just click self-explaining buttons and the thing works. The search function is also very nice, and navigating an outline view with the arrow keys, quickly collapsing subtrees as needed, is a very useful tool. Also, drag and drop.

nicky02• 3 years ago

What do you like about having to remember and execute a series of precise and arcane text commands instead of seeing everying comfortably and accessibly presented to you in a graphical form?

nottorp2• 3 years ago

Speed.

3142• 3 years ago

It's ok to like different things - there is no need to attack a different approach. If you find the visual layout comfortable and accessible then thank you for answering the question.

timbeccue• 3 years ago

For guis in general, I like how the actions available to me are much easier to learn, and therefore use. The information conveyed through the layout often provides context for related actions.

In my experience, CLIs are great for efficiency, if I am doing a task so often that it becomes rote behavior and learning the tool is no longer helpful, or if I want to automate it. I find my real world need for either of these to be relatively slim, but I am not surprised that it is common for others.

francois_h• 3 years ago

Isn’t this just a glorified lsof?

pqdbr• 3 years ago

It’s literally right there in the first line of the description, yes.

bbrks• 3 years ago

There's a fine line between glorified and shoulder-standing.

This project gives full credit to the giant it stands upon.

README.md:

Sloth is essentially a friendly, exploratory graphical user interface built on top of the lsof command line tool. The output of lsof is parsed and shown in a sortable, searchable outline view with all sorts of convenient additional functionality.

anonfunction• 3 years ago

Would be nice to have a dedicated "ports" view as this is what I most commonly use lsof for.

rswail2• 3 years ago

great little app. I had to approve it specifically in System Preferences > Security & Privacy > General because it's not signed, but that's a minor detail.

sva_2• 3 years ago

It would be cool if this was platform independent, since lsof exists on many UNIX-like platforms.

nottorp2• 3 years ago

You mean an Electron 'app' that takes 30 Gb of ram? :)

TheRealDunkirk• 3 years ago

This is the beauty of a non-walled-garden, general-purpose computer. I really hope that Apple keeps macOS this way, and doesn't try to close it off like iOS. There are many worrisome trends...

joshspankit2• 3 years ago

macOS is already a walled garden in many ways

r2222• 3 years ago

What would be the use cases for such tool? If I need to ask, I won’t need it?

11010100102• 3 years ago

Ah, yes, nothing like running an unaudited application as root for security! Especially love the part where the developer signs with a 1024-bit DSA key and then uses ssh as root to deploy to a public webserver the sparkle updates:

scp SlothAppcast.xml root@sveinbjorn.org:/www/sveinbjorn/html/files/appcasts/SlothAppcast.xml

The references to "Mac OS X" (now over 10 years old) are the cherry on top.

ayewo• 3 years ago

Are there obvious or latent vulnerabilities present in the app that needs to be called out so that devs can take precautions?

Also, mind sharing where you found this information about the public server bit?

11010100102• 3 years ago

https://github.com/sveinbjornt/Sloth/blob/master/sparkle/upd...

I haven't reviewed obj-c code in over a decade, but I do know anything running with root authorization needs to be scrutinized carefully. And seeing blocks of code copy-pasted from stackoverflow, references to a 10 year old operating system, use of SIGKILL instead of the proper SIGTERM, for example, does not exactly inspire the necessary confidence.

amjd• 3 years ago

For those looking for a way to filter open ports, check "IP sockets" and type "listen" in the search bar.

renewiltord• 3 years ago

This is definitely something that benefits from a UI. I can always `lsof` and `fzf` my way to it, but this helps. Thanks.

vram22• 3 years ago

Haven't used them for a while, but IIRC, the combination of lsof (which Sloth is based on) and fuser (including with the -k option) can be useful.

In fact I first found lsof when working on HP-UX servers. IIRC, it was written by an Indian-named guy who may have worked at HP.

ovebepari• 3 years ago

what does it do more than 'lsof' in gnu/linux systems?

Sloth – A Mac app that shows all open files, directories, sockets, etc.

Related Stories