I am just utility level familiar with lsof, but can Activity Monitor be used in some way? It might result in CPU usage spike for a little time, but it shows ports, threads and open files per process after double clicking on the process. And since you see, a lot of files are open, I suspect memory usage too, so apps can be sorted and check using sort.
Time to bring the power of Unix pipes, sort, and awk to the rescue. But since lsof takes a long time to run I'll save the output and analyze that, rather than piping lsof directly into the pipe.
For reference here's the lsof output format:
[iMac:~] droot% head /tmp/a
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
I just found the Sloth app. It is basically a GUI for lsof, and is able to group and sort processes by file count, which is exactly what I need. About the only thing I could ask for that is missing was a tally of the total number of open files in the system.
Years ago I had problems with FAT32, so I switched to NTFS. I had an external HD back in the day and one day the cable connection was interrupted by accident and I lost most of my files. So I switched to HFS+ with MacDrive. Same problem with the cable but I managed to restore everything.
After a while there was rumour that Apple was going to support ZFS and ...
Sure - the fsusage tool can show all filesystem operations live and you can sort on that path to determine what is doing the writing and back into the details.
sudo fs_usage -w | grep uuidtext
As you mention, the system can self fix by restart and updates. I’d guess OnyX didn’t help, but we’ll need to wait to get it to recur to know for sure.
Also, that ...