Here it is with support for Leopard and extended attributes.
All calls related to extended attributes are traced and dumped to /var/log/system.log (I find it more useful than _fsusage for this specific calls).
Check the .c file for options related to this.
For Leopard support you need to edit the .c file and change the define. I’m still searching for a better way to detect Leopard or Tiger in XCode. Maybe a Makefile flag. Suggestions?
The Info.plist file needs to be edited and key com.apple.kernel changed to 9.5.0 (for Leopard 10.5.5). Something to improve here too.
Currently I can’t get the name of the process while running on Leopard. Had no time to investigate why there’s no info from the structure while the same thing works on Tiger. To be fixed :-).
So grab the source here: onyx-the-black-cat.v0.2.src.tgz
If you find any problems or have any suggestions or code improvements feel free to post a comment or mail me.