88

I am looking for the OS X corespondent of FileMon, that was later included in ProcessMon.

BTW, it is essential to be able to filter by process.

1
  • I'll add three options - since the unix heritage of Mac OS X is different than the NT architecture - the tools don't overlap perfectly. Are you looking for an API to program or just tools to peek at what is currently happening (or trigger actions after a certain file changes)
    – bmike
    May 18, 2011 at 14:10

8 Answers 8

79

Instruments—a part of the Apple Xcode development suite—can monitor all file access and writes. Open it from /Applications/Xcode.app/Contents/Applications/Instruments.app, select your application or process, and press Start. You have extensive filter options available in the menus.

Older versions of Xcode are storing the App at /Developer/Applications/Instruments.app

6
  • 7
    As of Xcode 5, this is now located in /Applications/Xcode.app/Contents/Applications/Instruments.app - and can also be reached from within the XCode app - Xcode->Open Developer Tool->Instruments.
    – Mixologic
    Feb 3, 2014 at 16:15
  • 2
    This doesn't work if the file being accessed isn't happening because of your application Dec 14, 2017 at 21:36
  • Actually it doesn't works for OS X: "I/O activity does not support the macOS platform". Also read: stackoverflow.com/questions/35621938/…
    – user202579
    Dec 11, 2018 at 11:11
  • Can you provide more details on this? Which instrument - Activity Monitor? I'm seeing a long output for all processes here, not sure how to filter it to disk i/o for one process
    – Elliott
    May 24, 2019 at 15:22
  • I tried this on a dot file and it would not allow me to choose it.
    – John
    Feb 23, 2021 at 0:25
63

There is the command opensnoop. Run without arguments, it may overwhelm you with output, but it can be run with arguments -n name to limit output to processes named name.

3
20

No one has mentioned Activity Monitor, found in the /Applications/Utilities folder.

Click on the Process Name in the list, then hit the "Inspect" button on the toolbar.

There are three tabs in the resulting window: Memory, Statistics, Open Files and Ports. The Open Files and Ports tab will show all the open files being used by the process.

1
  • 1
    This doesn't work if the file is being accessed by an unknown application Dec 14, 2017 at 21:39
16

Launchd is the main system level tool for monitoring files (and a folder is a special file) since it's always running. Hazel is one program that helps put a pretty GUI around launchd WatchPaths. Look here for lots of tips on launchd as well as hundreds of tutorials, a good wikipedia article and the Apple dev docs.

fseventsd will log some changes - so you might use FSeventer or access those files if launchd isn't your cup of tea.

fs_usage and lsof are process aware command line tool to tap into the IO subsystem as it's running. The fs_usage buffer can get overloaded so if you want something more guaranteed and less of a "take a quick peek" it's less dependable for total correct results as the other commands.

4
  • I have used FSEventer quite a few times to find out what an application is accessing. This is great when looking for license files for system imaging for lab deployment. May 18, 2011 at 23:36
  • fseventer is excellent to have the big picture realtime, you really see what's going!.
    – ling
    Sep 19, 2015 at 5:21
  • 2
    Since FSeventer is dead, one could also try FSMonitor.
    – GDP2
    Feb 6, 2018 at 19:06
  • 1
    Doesn't seem like Hazel does this at all, at least anymore? Am I missing something?
    – pfrank
    Nov 28, 2020 at 16:00
4

lsof

command on the Terminal.app can do that for you? use the man lsof to catch up with it's use. Cheers

4

The faster way is:

$ lsof [path_to_file]

This solution doesn't require the root password and gives you back the following, clear, result:

COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
Finder     497  JR7   21r   REG    1,2   246223 33241712 image.jpg
QuickLook 1007  JR7  txt    REG    1,2   246223 33241712 image.jpg
2

Also available are iosnoop and iotop depending on your specific needs. These terminal commands can be piped through grep to watch for filesystem events from a specific process or against a specific file.

0

There's a graphical interface to lsof type information. It's donationware from HAMSoft and it's called What's Keeping Me. Designed to answer that "Why can't I delete this from my trash?" question that comes up every so often on OS X, it also happens to be a handy way to watch for open I/O handles on running processes if you're just curious about what's going on. It allows you some simple search and filtering.

1
  • The domain was taken over by another (shady-looking) outfit in 2022. You can still download a zip of the last version, 2.4, from the link at archive.org: web.archive.org/web/20210415173731/http://… It's an Intel binary, but works on Apple Silicon with Rosetta. Dec 2, 2023 at 22:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .