I am wondering if there is a way to see which files an application accesses (reads or writes) when starting up.

/usr/bin/fs_usage seems like one tool, but I wondered if there are others.

I am trying to make it easy to copy preferences between two computers, and I figured that this was one step approaching that goal, but I'm interested in the question for several reasons. I know preferences are usually kept in ~/Library/Preferences/ and ~/Library/Application Support, but how do I find out which files/folders specifically?


I think there's a couple of options. You could use a launchd script with a WatchPaths property that triggers on those directories.

You can also use the command-line tool lsof to list open files of a process.

You can inspect open files per-process using Activity Monitor. If you click on the process and click "Inspect", it should bring up additional information. One of the tabs here should be for open files (see below).

enter image description here

| improve this answer | |

When I'm curious about things like this, I immediately turn to fseventer. It is essentially a GUI for fs_usage, and simply presents a list of files as they're being modified/created/deleted. In the default tree view mode, you good a nice hierarchy of files modified and their paths. In tree view, you can hover over a file or directory with a red (i) icon over it and see which application touched it.

Over in the second tab (grid mode), you can easily see which files were modified by an application. Screenshots of each of these are on fseventer's homepage.

There are a lot of nice options to tailor the output to exactly what you need, such as when (if ever) files should disappear from the list, various output views, and a few more nice-to-haves.

fseventer is free, donations-suggested; some people call it "nag-ware" because you have to dismiss a donation dialog on application start.

| improve this answer | |

Another option is the opensnoop DTrace script. It traces file opens and can show various details, like time (-v) and error codes (-e). You can also restrict snooping to a particular process (-n or -p). The man page (run man opensnoop) has all the details.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .