What tools can be used to monitor system activity under OS X? I am interested in which files are modified or created while using a specific app, Safari to be exact. I am familiar with fs_usage, but I find it cumbersome, since I do not want to monitor read actions, just write.

2 Answers 2


I will edit my answer with hyperlinks whence not on my phone, but..

a. The built-in OSX utility,sudo iotop, provides a greppable stream of all fsevents...

enter image description here

and / or

b. FSEventer.app provides a nice GUI around roughly the same info as the aforementioned ... (with easy filtering, and a nice array of options for different tree representations, etc.)

enter image description here

  • 1
    iotop and similar like DTrace don't running under El Capitan. You need to disable System integrity Protection. Instead you can use fs_usage or as @iWill mentioned, instruments in XCode.
    – dante12
    May 20, 2016 at 22:03

Instruments is a tool that comes with Xcode. This tool was designed to help developers get a lot of detail about what was happening on a computer when their software is run. One of the things it can do is watch all file I/O. If you run the program and add the File I/O instrument, you can attach it to safari and see what happens. You can also filter and sort the output.

More information can be found on the Xcode page from Apple.

  • Thanks! I went to instruments, lauch System Usage and selected Safari as target. The problem is that "Record" button is greyed out. Is is greyed out for every app actually. Do you know why is that so?
    – sanjihan
    May 16, 2016 at 21:13
  • Oh, it looks like that this Instrument does not support os x platform. No luck here I guess
    – sanjihan
    May 16, 2016 at 21:15
  • Certain processes are protected in OS X 10.11. I expect there is a way around this but I don't know what it is off the top of my head. My guess is it involves system integrity protection.
    – iWill
    May 19, 2016 at 18:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .