5

Is there a way to continually trace/log which software is creating and accessing files on my system?

I assume these log files would grow very large unless trimmed.

I see a bunch of dot files and no way to know what application or installation created these files.

For instance in Application Support ~/Library/Application Support/

enter image description here

I have tried using some Terminal commands to get information: od -tx1 file strings man info

The impetus for this question is the prevalence of malware, tracking software, caches, etc - so a regular user can know the providence of the files on their system. I believe the system admin term for this process called Auditing.

I am aware that many software vendors store license info inside dot files on the system.

Improve this question
7
  • 1
    In Terminal: man fs_usage
    – user3439894
    Sep 9, 2021 at 21:13
  • @user3439894 I read through the man page. Don't see a way to trace what process created a file in the past.
    – John
    Sep 9, 2021 at 23:47
  • 1
    You did fire off, at my count, 5 questions. @user3439894 provided an answer for your first question and, by implication, your second (yes). That was what you asked. Perhaps you could change your post to a simpler set of questions which make it clear that you are only interested in getting information about past file access.
    – Gilby
    Sep 10, 2021 at 11:22
  • @Gilby I asked a main question and a closely related follow up. Is there a limit? “Is there a way to continually trace/log which software is creating and accessing files on my system?”
    – John
    Sep 11, 2021 at 3:59
  • 1
    Re Auditing I can find apple.stackexchange.com/questions/304893/… and apple.stackexchange.com/questions/12735/… which relate to using the OpenBSM Audit system included in macOS. This is a complex topic - I know about it, but have never used it.
    – Gilby
    Sep 11, 2021 at 4:16

1 Answer 1

Reset to default
2

@Gilby provided an answer that fits the question perfectly... OpenBSM developed by Apple.

Resources available:

Quick and Dirty OpenBSM Auditing In macOS
A high-level evaluation of the OpenBSM audit system in OS X
AUDIT IN A OS X SYSTEM
Reading Mac BSM Audit Logs
Getting Cozy With OpenBSM Auditing On MacOS - Patrick Wardle

Question and answer on StackExchange:

OS X Private Folder - Runaway file "crash recovery" 126.61GB!
Find out if any files were exported from my MacBook

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .