I have several external hard drives. They're consumer drives which "go to sleep" (spin down) automatically when unused; I can't (and don't want to) run them 24x7. I use them strictly for backup and long-term storage.

Very often, I'll use some irrelevant feature of a program (like "Undo" in Microsoft Word on a doc that's on the main drive) -- the application will freeze, and I'll hear an external hard drive spin up. (Or every single drive spin up, one at a time.) Then the program will unfreeze. The program does not seem to be bothered if I unmount the drives; it simply stops doing that.

And I am wondering: What on earth is it looking for? So I can figure out how to stop this annoyance. For instance if it's tapping fonts it found on the external drive, I can make sure they're inaccessible inside ZIP files.

My question is: How can I have a persistent log of accesses to files by applications? I've tried using lsof | grep /Volumes/ but it is only a snapshot of currently open files; it always seems to miss the moment when that app has that file open.

I tried the fs_usage approach, got bursts of this message: fs-usage: buffer overrun, events generated too quickly: 123456 But eventually this surfaced:

23:32:47  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000006   Microsoft Ex
23:32:47  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000002   Microsoft Ex
23:32:59  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000005   Microsoft Ex
23:32:59  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000002   Microsoft Ex
23:32:59  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000003   Microsoft Ex
23:32:59  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000002   Microsoft Ex

This happened as I was closing an Excel spreadsheet. That's a scratchpad disk, and that directory was deleted years ago. The spreadsheet was a new file that had nothing to do with that location.

Searching the drive for the text string RSreorg revealed only 2 files, both ~/Library/Preferences/com.microsoft.office.plist, one with gibberish at the end (temporary file?)... Web search reveals Microsoft stores my license keys there, but text scan reveals hundreds of other useless and wrong directories. What on earth is Microsoft doing?

And apparently this answer endorses deleting the file outright.

2 Answers 2


You can use fs_usage to see all system calls related to filesystem activities. Output is quite large, so you probably need to redirect it to a file

  1. Run sudo fs_usage > fs.out in Terminal
  2. Start Word and wait for the external drive to spin up
  3. Switch to Terminal, press Ctrl-C and look through fs.out

You can also limit the output to certain processes, see the man page for details on that.


There used to be a nice free graphical app called fseventer to do this, but it didn't really work in 10.9 or later, and doesn't seem to be generally available any more.

You could try opensnoop, a command line utility that shows files being accessed in real time. Its simplest invocation is:

$ sudo opensnoop

which will give you a live updating list of every file being accessed on the system. If you suspect a particular application, you can filter its output to show only what that application is doing:

$ sudo opensnoop -n Word

(IIRC it does partial but case-sensitive name matching, so "Word" will match "Word", "MS Word", "Microsoft Word", etc. but not "word".)

Or you can use it to see what's accessing a particular file (example only, I've no idea if this is a real MS Word preference file):

$ sudo opensnoop -f /Library/Preferences/com.microsoft.msword

For other options, see the man page.

  • There is a commercial version of fseventer now called FSMonitor, sadly it costs around 20 USD.
    – lony
    Commented Mar 10, 2020 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .