Using the command line tool ‘opensnoop’ you can track any Mac applications (or system process) usage of the file system. This is a very handy tool for administrators and troubleshooting! The simplest way to use it is as follows:



sudo opensnoop -n Safari

You can also track a specific file, and what is accessing it, like so:

sudo opensnoop -f /etc/hosts

Tracking a specific process is as simple as just specifying the process id:

sudo opensnoop -p PID

opensnoop will keep tracking the file until the process itself is ended, so just hit Control-C in the Terminal to stop opensnoop from running. In case you’re wondering, opensnoop is based on DTrace, a popular UNIX tool.

The uses are infinite, give it a try, or read more about opensnoop