{"id":10991,"date":"2018-07-06T13:34:53","date_gmt":"2018-07-06T18:34:53","guid":{"rendered":"https:\/\/rud.is\/b\/?p=10991"},"modified":"2018-07-07T08:00:18","modified_gmt":"2018-07-07T13:00:18","slug":"visualizing-macos-app-usage","status":"publish","type":"post","link":"https:\/\/rud.is\/b\/2018\/07\/06\/visualizing-macos-app-usage\/","title":{"rendered":"Visualizing macOS App Usage with a Little Help from osqueryr & mactheknife"},"content":{"rendered":"

Both my osqueryr<\/code> and macthekinfe<\/code> packages have had a few updates and I wanted to put together a fun example (it being Friday, and all) for what you can do with them. All my packages are now on GitHub and GitLab and I’ll be maintaining them on both so I can accommodate the comfort-level of any and all contributors but will be prioritizing issues and PRs on GitLab ahead of any other platform. Having said that, I’ll mark non-CRAN packages with a # notcran<\/code> comment in the source views so you know you need to install it from wherever you like to grab sketch packages from.<\/p>\n

One table that osquery<\/code> makes available under macOS is an inventory of all “apps” that macOS knows about. Previous posts have shown how to access these tables via the dplyr<\/code> interface I built for osquery<\/code>, but they involved multiple steps and as I started to use it more regularly (especially to explore the macOS 10.14 beta I’m running) I noticed that it could use some helper functions. One in particular — osq_expose_tables()<\/code> — is pretty helpful in that it handles all the dplyr<\/code> boilerplate code and makes table(s) available in the global environment by name. It takes a single table name or regular expression and then exposes all matching entities. While the function has a help page, it’s easier just to see it in action. Let’s expose the apps<\/code> table:<\/p>\n

library(osqueryr) # notcran\nlibrary(tidyverse)\n\nosq_expose_tables(\"apps\")\n\napps\n## # Source:   table [?? x 19]\n## # Database: OsqueryConnection\n##    applescript_enab\u2026 bundle_executable    bundle_identifier   bundle_name  bundle_package_\u2026\n##                                                                   \n##  1 0                 1Password 6          com.agilebits.onep\u2026 1Password 6  APPL            \n##  2 0                 2BUA8C4S2C.com.agil\u2026 2BUA8C4S2C.com.agi\u2026 1Password m\u2026 APPL            \n##  3 1                 Adium                com.adiumX.adiumX   Adium        APPL            \n##  4 1                 Adobe Connect        com.adobe.adobecon\u2026 Adobe Conne\u2026 APPL            \n##  5 1                 Adobe Illustrator    com.adobe.illustra\u2026 Illustrator\u2026 APPL            \n##  6 \"\"                AIGPUSniffer         com.adobe.AIGPUSni\u2026 AIGPUSniffer APPL            \n##  7 \"\"                CEPHtmlEngine Helper com.adobe.cep.CEPH\u2026 CEPHtmlEngi\u2026 APPL            \n##  8 \"\"                CEPHtmlEngine        com.adobe.cep.CEPH\u2026 CEPHtmlEngi\u2026 APPL            \n##  9 \"\"                LogTransport2        com.adobe.headligh\u2026 LogTranspor\u2026 APPL            \n## 10 \"\"                droplet              \"\"                  Analyze Doc\u2026 APPL            \n## # ... with more rows, and 14 more variables: bundle_short_version ,\n## #   bundle_version , category , compiler , copyright ,\n## #   development_region , display_name , element , environment ,\n## #   info_string , last_opened_time , minimum_system_version , name ,\n## #   path <\/code><\/pre>\n
There’s tons of info on all the apps macOS knows about, some of which are system services and “helper” apps (like Chrome’s auto-updater). One field — last_opened_time<\/code> — caught my eye and I thought it would be handy to see which apps had little use (i.e. ones that haven’t been opened in a while) and which apps I might use more frequently (i.e. ones with more recent “open” times). That last_open_time<\/code> is a fractional POSIX timestamp and, due to the way  osquery<\/code> created the schemas, it’s in a character field. That’s easy enough to convert and then arrange()<\/code> the whole list in descending order to let you see what you use most frequently.<\/p>\n
But, this is R and we can do better than a simple table or even a DT::datatable()<\/code>.<\/p>\n
I recently added the ability to read macOS property lists (a.k.a. “plists”) to mactheknife<\/code> by wrapping a Python module (plistlib<\/code>). Since all (OK, “most”) macOS apps have an icon, I thought it would be fun to visualize the last opened frequency for each app using the app icons and ggplot2<\/code>. Unfortunately, the ImageMagick (and, thus the magick<\/code> package) cannot read macOS icns<\/code> files, so you’ll need to do a brew install libicns<\/code> before working with any of the remaining code since we’ll be relying on a command-line utility from that formula.<\/p>\n
Let’s get the frontmatter out of the way:<\/p>\n
library(sys)\nlibrary(magick)\nlibrary(osqueryr) # notcran\nlibrary(mactheknife) #notcran\nlibrary(ggimage)\nlibrary(hrbrthemes)\nlibrary(ggbeeswarm)\nlibrary(tidyverse)\n\nosq_expose_tables(\"apps\")\n\n# macOS will use a generic app icon when none is present in an app bundle; this is the location and we'll\n# need to use it when our plist app spelunking comes up short\n\ndefault_app <- \"\/System\/Library\/CoreServices\/CoreTypes.bundle\/Contents\/Resources\/GenericApplicationIcon.icns\"\n<\/code><\/pre>\n
Next, we'll:<\/p>\n