Trace file reads and writes on os x?

Question

I have something running that is syncing two directories. I want to turn it off but cannot figure out what it is. El Capitan, if that matters.

Can someone provide a command or tool that will reliably show the pid (and ideally the command) for every file read and write operation?

I assume this is possible with something dtrace-based but have not been able to figure it out.

(Login items are empty for the relevant user. Crontab is empty for both the relevant user and root.)

Thank you for your help.

Answer 1

You are looking for the fs_usage command, which will show any file-related activity either on the whole system or by file.

For starters, do

sudo fs_usage

From man fs_usage

NAME

fs_usage -- report system calls and page faults related to filesystem activity in real-time

SYNOPSIS

fs_usage [-e] [-w] [-f mode] [-b] [-t seconds] [-R rawfile [-S start_time] [-E
         end_time]] [pid | cmd [pid | cmd] ...]

DESCRIPTION

The fs_usage utility presents an ongoing display of system call usage information per- taining to filesystem activity. It requires root privileges due to the kernel tracing facility it uses to operate. By default, the activity monitored includes all system processes except the running fs_usage process, Terminal, telnetd, sshd, rlogind, tcsh, csh and sh. These defaults can be overridden such that output is limited to include or exclude a list of processes specified by the user.