I have two users on my system, 501 and 505. 501 can sudo, 505 can not. I was logged in in the GUI as 505 and wanted to see what files that were read when I launched a certain program so to run opensnoop I open a terminal su:d to 501 and then just executed
sudo opensnoop 2>/dev/null.
Strangely (?) enough, launching, in the GUI, a program as 505 didn't generate any output from opensnoop at all (I just saw the occasional 501 related output, which is surprising in itself considering 501 have 35 GUI based applications open as well as several CLI programs running).
Does opensnoop only list processes belonging to the user that runs the command (but what about sudo???)? Or why does it not report any file i/o when launching Safari?