How to monitor file access for an OS X application?

Question

I am looking for the OS X corespondent of FileMon, that was later included in ProcessMon.

BTW, it is essential to be able to filter by process.

I'll add three options - since the unix heritage of Mac OS X is different than the NT architecture - the tools don't overlap perfectly. Are you looking for an API to program or just tools to peek at what is currently happening (or trigger actions after a certain file changes) — bmike, May 18 '11 at 14:10

score 79 · Accepted Answer · edited Sep 15 '15 at 17:23

79

Instruments—a part of the Apple Xcode development suite—can monitor all file access and writes. Open it from /Applications/Xcode.app/Contents/Applications/Instruments.app, select your application or process, and press Start. You have extensive filter options available in the menus.

Older versions of Xcode are storing the App at /Developer/Applications/Instruments.app

edited Sep 15 '15 at 17:23

phobie

103

answered May 18 '11 at 23:06

Daniel

3,898

7

As of Xcode 5, this is now located in /Applications/Xcode.app/Contents/Applications/Instruments.app - and can also be reached from within the XCode app - Xcode->Open Developer Tool->Instruments. – Mixologic Feb 03 '14 at 16:15
2

This doesn't work if the file being accessed isn't happening because of your application – liquidblueocean Dec 14 '17 at 21:36
Actually it doesn't works for OS X: "I/O activity does not support the macOS platform". Also read: https://stackoverflow.com/questions/35621938/xcode-instruments-this-instrument-does-not-support-osx – Dec 11 '18 at 11:11
Can you provide more details on this? Which instrument - Activity Monitor? I'm seeing a long output for all processes here, not sure how to filter it to disk i/o for one process – Elliott May 24 '19 at 15:22
I tried this on a dot file and it would not allow me to choose it. – John Feb 23 '21 at 00:25
How to monitor application from start? – andyf Oct 11 '22 at 06:14

score 63 · Answer 2 · answered May 18 '11 at 19:15

63

There is the command opensnoop. Run without arguments, it may overwhelm you with output, but it can be run with arguments -n name to limit output to processes named name.

answered May 18 '11 at 19:15

Harald Hanche-Olsen

4,149

1

Similarly sudo opensnoop | grep .classpath gives you accesses to a classpath file for example. – Dávid Natingga Aug 08 '13 at 19:18
3

Note opensnoop and Instruments are both front-ends to the same DTrace engine. Other front-ends: http://dtrace.org/blogs/brendan/2011/10/10/top-10-dtrace-scripts-for-mac-os-x/ – MarcH Nov 27 '18 at 19:11
See https://apple.stackexchange.com/questions/343423/opensnoop-dtrace-error-on-enabled-probe-id-5-id-163-syscallopenreturn-i if you want to get rid of the dtrace error – lony Mar 10 '20 at 10:27

score 21 · Answer 3 · edited Mar 19 '15 at 09:54

21

No one has mentioned Activity Monitor, found in the /Applications/Utilities folder.

Click on the Process Name in the list, then hit the "Inspect" button on the toolbar.

There are three tabs in the resulting window: Memory, Statistics, Open Files and Ports. The Open Files and Ports tab will show all the open files being used by the process.

edited Mar 19 '15 at 09:54

jherran

13,284

answered May 18 '11 at 19:55

ghoppe

8,046

1

This doesn't work if the file is being accessed by an unknown application – liquidblueocean Dec 14 '17 at 21:39

bmike · Answer 4 · 2011-05-18T14:13:14.803

16

Launchd is the main system level tool for monitoring files (and a folder is a special file) since it's always running. Hazel is one program that helps put a pretty GUI around launchd WatchPaths. Look here for lots of tips on launchd as well as hundreds of tutorials, a good wikipedia article and the Apple dev docs.

fseventsd will log some changes - so you might use FSeventer or access those files if launchd isn't your cup of tea.

fs_usage and lsof are process aware command line tool to tap into the IO subsystem as it's running. The fs_usage buffer can get overloaded so if you want something more guaranteed and less of a "take a quick peek" it's less dependable for total correct results as the other commands.

edited May 18 '11 at 14:13

answered May 18 '11 at 14:07

bmike

235,889

I have used FSEventer quite a few times to find out what an application is accessing. This is great when looking for license files for system imaging for lab deployment. – Digitalchild May 18 '11 at 23:36
fseventer is excellent to have the big picture realtime, you really see what's going!. – ling Sep 19 '15 at 05:21
2

Since FSeventer is dead, one could also try FSMonitor. – GDP2 Feb 06 '18 at 19:06
1

Doesn't seem like Hazel does this at all, at least anymore? Am I missing something? – pfrank Nov 28 '20 at 16:00

score 4 · Answer 5 · answered Nov 01 '13 at 08:41

The faster way is:

$ lsof [path_to_file]

This solution doesn't require the root password and gives you back the following, clear, result:

COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
Finder     497  JR7   21r   REG    1,2   246223 33241712 image.jpg
QuickLook 1007  JR7  txt    REG    1,2   246223 33241712 image.jpg

score 4 · Answer 6 · answered May 18 '11 at 14:09

4

lsof

command on the Terminal.app can do that for you? use the man lsof to catch up with it's use. Cheers

answered May 18 '11 at 14:09

kOoLiNuS

49

score 2 · Answer 7 · answered Jul 05 '15 at 15:59

2

Also available are iosnoop and iotop depending on your specific needs. These terminal commands can be piped through grep to watch for filesystem events from a specific process or against a specific file.

answered Jul 05 '15 at 15:59

beporter

161

score 0 · Answer 8 · answered May 18 '11 at 18:33

0

There's a graphical interface to lsof type information. It's donationware from HAMSoft and it's called What's Keeping Me. Designed to answer that "Why can't I delete this from my trash?" question that comes up every so often on OS X, it also happens to be a handy way to watch for open I/O handles on running processes if you're just curious about what's going on. It allows you some simple search and filtering.

answered May 18 '11 at 18:33

Ian C.

45,969

The domain was taken over by another (shady-looking) outfit in 2022. You can still download a zip of the last version, 2.4, from the link at archive.org: https://web.archive.org/web/20210415173731/http://www.hamsoftengineering.com/products/wkm/wkm.html It's an Intel binary, but works on Apple Silicon with Rosetta. – Elhem Enohpi Dec 02 '23 at 22:26

How to monitor file access for an OS X application?

8 Answers8

Linked