I'm trying to figure out what process is periodically and silently erasing the contents of the /etc/hosts file on a Mac. I tried using:

sudo fs_usage | grep hosts

but it only generates a few seconds of output and then returns me to the command prompt, after which trying to restart fs_usage tells me:

ktrace_start: Resource busy

Once that happens, the only way I know how to re-enable fs_usage is to restart the computer, as I can't find either fs_usage or the ktrace process. Piping the output of grep to a text file generated nothing and behaved the same way.

  1. Why is grep ceasing all output after a few seconds?
  2. How can I make fs_usage available again without restarting?

1 Answer 1


I have also encountered same problem today and after some trail and error, I got it working without restarting the mac.

Try to find the pid of all the processes with name fs_usage and kill it.

$ ps -e | grep fs_usage

Then kill the processes using the pid

$sudo kill -9 pid

But your statement

I can't find either fs_usage or the ktrace process.

I didn't understand why you didn't find the process.

Try my solution and update me!

  • 1
    The problem happens when fs_usage is running and then terminates without being sent a quit signal (Control C or such) and either that quit leaves the ktrace locked or the ktrace lock is causing fs_usage to abort early. I haven't gotten this to reproduce and pick apart, but this still happened on occasion on 10.13.6
    – bmike
    Jul 24, 2019 at 13:01
  • @bmike Thanks for the “why” part Jul 24, 2019 at 13:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .