I use "opensnoop"


to show all files which are opened from different processes.

But when I want to specific a file with

sudo opensnoop -n "directory/filename"

i'm getting this error:

token too large, exceeds YYLMAX

I'm hunting around for a fix and found only this website. The author modified the opensnoop script:

this is due to line 154 in /usr/bin/opensnoop containing inline string NAME = "'$pname'"; that produces a dtrace script with this quoting inline string NAME = "foo' 'bar"; and the first single quote ends the dtrace invocation leaving its input script incomplete. The quick patch is to replace line 154 with inline string NAME = "'"$pname"'";

but i'm still getting this error message.

Can anybody help me? Or tell me another utility where i can show the app which is currently working with a specific file?

  • 1
    -n is used to identify the process name to be snooped, why do you need a path for that?
    – nohillside
    Commented Apr 14, 2013 at 15:23
  • @patrix For example sudo opensnoop -n System\ Preferences prints that same error, and -f doesn't work with paths that have spaces either.
    – Lri
    Commented Apr 14, 2013 at 16:41

1 Answer 1


-n is only meant to be used with process names like sudo opensnoop -n System\ Preferences. To see what processes access a file, use sudo opensnoop -f /tmp/a\ b.txt.

The change mentioned in the blog post fixes -n but not -f. To fix both of them, edit /usr/bin/opensnoop and replace these lines:

inline string PATHNAME = "'$pathname'";
inline string NAME = "'$pname'";

With this:

inline string PATHNAME = "'"$pathname"'";
inline string NAME = "'"$pname"'";
  • Thank's! But, for example, when i open up a screenshot via Preview, and opensoop -n "Screenshot", no processes are shown. Shouldn't there been the "Preview-Process"?
    – ohboy21
    Commented Apr 14, 2013 at 16:56
  • You're supposed to use something like sudo opensnoop -f ~/Pictures/Screenshot.png.
    – Lri
    Commented Apr 14, 2013 at 17:11
  • Ahhh....how stupid could i be... sure! Thank's very much! RTFM... :)
    – ohboy21
    Commented Apr 14, 2013 at 17:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .