66

I am looking for the OS X corespondent of FileMon, that was later included in ProcessMon.

BTW, it is essential to be able to filter by process.

  • I'll add three options - since the unix heritage of Mac OS X is different than the NT architecture - the tools don't overlap perfectly. Are you looking for an API to program or just tools to peek at what is currently happening (or trigger actions after a certain file changes) – bmike May 18 '11 at 14:10
66

Instruments—a part of the Apple Xcode development suite—can monitor all file access and writes. Open it from /Applications/Xcode.app/Contents/Applications/Instruments.app, select your application or process, and press Start. You have extensive filter options available in the menus.

Older versions of Xcode are storing the App at /Developer/Applications/Instruments.app

| improve this answer | |
  • 7
    As of Xcode 5, this is now located in /Applications/Xcode.app/Contents/Applications/Instruments.app - and can also be reached from within the XCode app - Xcode->Open Developer Tool->Instruments. – Mixologic Feb 3 '14 at 16:15
  • This doesn't work if the file being accessed isn't happening because of your application – liquidblueocean Dec 14 '17 at 21:36
  • Actually it doesn't works for OS X: "I/O activity does not support the macOS platform". Also read: stackoverflow.com/questions/35621938/… – user202579 Dec 11 '18 at 11:11
  • Can you provide more details on this? Which instrument - Activity Monitor? I'm seeing a long output for all processes here, not sure how to filter it to disk i/o for one process – Elliott May 24 '19 at 15:22
48

There is the command opensnoop. Run without arguments, it may overwhelm you with output, but it can be run with arguments -n name to limit output to processes named name.

| improve this answer | |
13

Launchd is the main system level tool for monitoring files (and a folder is a special file) since it's always running. Hazel is one program that helps put a pretty GUI around launchd WatchPaths. Look here for lots of tips on launchd as well as hundreds of tutorials, a good wikipedia article and the Apple dev docs.

fseventsd will log some changes - so you might use FSeventer or access those files if launchd isn't your cup of tea.

fs_usage and lsof are process aware command line tool to tap into the IO subsystem as it's running. The fs_usage buffer can get overloaded so if you want something more guaranteed and less of a "take a quick peek" it's less dependable for total correct results as the other commands.

| improve this answer | |
  • I have used FSEventer quite a few times to find out what an application is accessing. This is great when looking for license files for system imaging for lab deployment. – Digitalchild May 18 '11 at 23:36
  • fseventer is excellent to have the big picture realtime, you really see what's going!. – ling Sep 19 '15 at 5:21
  • 1
    Since FSeventer is dead, one could also try FSMonitor. – GDP2 Feb 6 '18 at 19:06
11

No one has mentioned Activity Monitor, found in the /Applications/Utilities folder.

Click on the Process Name in the list, then hit the "Inspect" button on the toolbar.

There are three tabs in the resulting window: Memory, Statistics, Open Files and Ports. The Open Files and Ports tab will show all the open files being used by the process.

| improve this answer | |
  • 1
    This doesn't work if the file is being accessed by an unknown application – liquidblueocean Dec 14 '17 at 21:39
3

lsof

command on the Terminal.app can do that for you? use the man lsof to catch up with it's use. Cheers

| improve this answer | |
3

The faster way is:

$ lsof [path_to_file]

This solution doesn't require the root password and gives you back the following, clear, result:

COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
Finder     497  JR7   21r   REG    1,2   246223 33241712 image.jpg
QuickLook 1007  JR7  txt    REG    1,2   246223 33241712 image.jpg
| improve this answer | |
1

Also available are iosnoop and iotop depending on your specific needs. These terminal commands can be piped through grep to watch for filesystem events from a specific process or against a specific file.

| improve this answer | |
0

There's a graphical interface to lsof type information. It's donationware from HAMSoft and it's called What's Keeping Me. Designed to answer that "Why can't I delete this from my trash?" question that comes up every so often on OS X, it also happens to be a handy way to watch for open I/O handles on running processes if you're just curious about what's going on. It allows you some simple search and filtering.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .