I think many of us have been disappointed with the effective demise of fseventer. What is a good dtrace shell based alternative to fseventer that will display all full paths of files being accessed for a defined application?


They're not quite a 100% fit, but if you'd like to monitor file access for an application I find a combination of opensnoop and fs_usage works well. Only opensnoop uses DTrace though.

  • Yeah, I have explored both of those rather heavily, but I fear that I'm not getting full path information at times. Have you seen any indication of how thorough opensnoop actually is as far as actually getting the full and complete paths? One thing I did not realize before today was that I can actually use opensnoop with a -n name argument of a not yet existent process name and it will then attach to the process after it is running, which may do the job. – ylluminate Jul 16 '15 at 13:43

The command below finds files that have been modified recently. (It's not what the OP asked but it's mostly what I used fseventer for.)

mdfind 'kMDItemFSContentChangeDate>$time.now(-300)'

mdimport -A lists the names of other metadata attributes.

kMDItemContentModificationDate is taken from EXIF data for files that have EXIF data. I didn't have many files with kMDItemUserModifiedDate within the last year, but they were files I had opened with TextEdit, Script Editor, or Skim.

There doesn't seem to be a metadata attribute for access time. kMDItemAttributeChangeDate is defined as "The date and time of the last change made to a metadata attribute".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .