homepage

I thought I was on to something when I found this technique for using dtrace to detect a file deletion: https://blogs.oracle.com/zoneszone/entry/who_keeps_removing_that_file
However, I don't seem to have privilege to run it.
$ cat trap-aliases-delete 
#! /usr/sbin/dtrace -wqs
syscall::unlinkat:entry
/cleanpath(copyinstr(arg1)) == "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/encodings/aliases.py"/
{
 stop();
 printf("%s[%d] caught removing aliases.py\n", execname, pid);
 system("ptree %d; pstack %d; prun %d", pid, pid, pid);
}
$ sudo ./trap-aliases-delete
dtrace: system integrity protection is on, some features will not be available
dtrace: could not enable tracing: Permission denied