What are st_flags (user defined flags) for a file Mac OS X?

Question

I am trying to detect when Dropbox is busy updating a file in a user's Dropbox in Mac OS X. By running stat(1) or stat(2) on a file, I see that the user defined flags for file (st_flags) are normally 0x40, but while Dropbox is updating the file they change to 0x00 for a couple seconds.

Poking around my Desktop and other folders, I see that ~95% of files have flags value 0x00 but about 5% have value 0x40. So it may be not just a Dropbox implementation detail. I cannot discern any pattern for predicting which files have 0x40 flags. Does anyone know what these values mean? Who is the "user" that is defining them?

Answer 1

Well even though Martin essentially answered this with a very educated guess, I'm entering this as an answer because it's too long to enter as a comment.

Here is the evidence…

• Indeed, 10.7 is when Auto Save and Versions was introduced, so that's why you don't see UF_TRACKED in stat.h in 10.6.

• I tried my experiment on a Mac running Mac OS X 10.7 and it behaves the same as in 10.8.

• There is a pattern: Document files created by some applications, which after examining a few appear to be those which have adopted Auto Save and Versions, are the ones which have the UF_TRACKED = 0x40.

• Another experiment. I renamed the revision daemon executable in Mac OS X,

/System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/Support/revisiond

then restarted the Mac, and monitored the UF_TRACKED state of a document file in Dropbox which had 0x40. I then changed the file on another Mac, so that Dropbox would push it to this Mac with the revision daemon disabled. Result: The UF_TRACKED state of the file changed from 0x40 to 0x00, but this time it did not change back to 0x40 after 2 seconds.

• It did change to 0x40 30 seconds later, after I restored the revision daemon to its original name, and it relaunched. (Apparently revisiond is started by launchd with a KeepAlive attribute.)

==================

So the evidence is overwhelming that Martin's guess is correct. It is Apple's revision daemon and not Dropbox which is setting UF_TRACKED to 0x40. The meaning of this bit is that its document revision is being tracked by Lion Auto Save and Versions.

Answer 2

The flags can be set with the chflags command line tool or the chflags() system call (see man 2 chflags). The values can be found in "/usr/include/sys/stat.h".

UF_TRACKED seems to be a bit special. It is documented in "sys/stat.h"

#define UF_TRACKED    0x00000040 /* file renames and deletes are tracked */

but not in the "chflags" man-page.

Unfortunately, I cannot tell you what "tracked" precisely means, but perhaps this helps already to find more information.