So - please forgive me if I’m just looking too closely at log files and leaping to wrong conclusions from them - is it not to be expected that, on a system doing Internet incremental backups, where a full backup was completed yesterday and has hardly been touched since (other than running backups), I would expect to see a lot of system log entries like this? (Because that’s what I am seeing…)
2020-07-09 18:00:47: Parallel hash "/Applications/Safari.app/Contents/PkgInfo" id=49530 hash=
2020-07-09 18:00:47: Parallel hash "/Applications/Safari.app/Contents/version.plist" id=49531 hash=
2020-07-09 18:00:47: Parallel hash "/Applications/Safari.app/Contents/MacOS/Safari" id=49533 hash=+kVYAbJ1OTRi3VBEmylZFTCr76K9ANLEr2I4MDu0zBvgvsdHAQDQAwEAAAABAAAAAQAAAAEAAAABAAAAAQAAAA--
2020-07-09 18:00:47: Parallel hash "/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/Info.plist" id=49539 hash=
2020-07-09 18:00:47: Parallel hash "/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/version.plist" id=49540 hash=
2020-07-09 18:00:47: Parallel hash "/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension" id=49542 hash=SvHp1ijYJJ+zrUxHuLoGaRelVTbbMEuPmNNq3geHrtXbr0PZLLpR3wVKOnoBAFAFAQAAAAEAAAABAAAAAQAAAA--
2020-07-09 18:00:47: Parallel hash "/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/_CodeSignature/CodeResources" id=49545 hash=wFujiBPUxnJ3KLuVQrFZrWPJ2SoBAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAQAAAA--
Safari hasn’t been touched since the previous backups (running at hourly intervals) - but it looks like the files are being rehashed each time.
Of course the other possibility is that this is a quirk of the macOS build I’m running, and that this is not expected behaviour on a supported platform - so presumably something about how macOS is reporting the timestamps is off?
Indeed - I’m building up to that…
Unfortunately APFS is not yet well documented for developers - so I’m not sure such things are accessible from a public API.