Jay Taylor's notes

back to listing index

How to monitor file access for an OS X application?

[web search]
Original source (apple.stackexchange.com)
Tags: os-x Mac profiling apple.stackexchange.com
Clipped on: 2015-11-02

I am looking for the OS X corespondent of FileMon, that was later included in ProcessMon.

BTW, it is essential to be able to filter by process.

asked May 18 '11 at 13:57
Image (Asset 3/12) alt=
I'll add three options - since the unix heritage of Mac OS X is different than the NT architecture - the tools don't overlap perfectly. Are you looking for an API to program or just tools to peek at what is currently happening (or trigger actions after a certain file changes) – bmike May 18 '11 at 14:10
up vote 25 down vote accepted

Instruments—a part of the Apple Xcode development suite—can monitor all file access and writes. Open it from /Applications/Xcode.app/Contents/Applications/Instruments.app, select your application or process, and press Start. You have extensive filter options available in the menus.

Older versions of Xcode are storing the App at /Developer/Applications/Instruments.app

answered May 18 '11 at 23:06
Image (Asset 5/12) alt=
5 upvote
As of Xcode 5, this is now located in /Applications/Xcode.app/Contents/Applications/Instruments.app - and can also be reached from within the XCode app - Xcode->Open Developer Tool->Instruments. – Mixologic Feb 3 '14 at 16:15

There is the command opensnoop. Run without arguments, it may overwhelm you with output, but it can be run with arguments -n name to limit output to processes named name.

answered May 18 '11 at 19:15
Image (Asset 6/12) alt=
Similarly sudo opensnoop | grep .classpath gives you accesses to a classpath file for example. – Dávid Tóth Aug 8 '13 at 19:18

Launchd is the main system level tool for monitoring files (and a folder is a special file) since it's always running. Hazel is one program that helps put a pretty GUI around launchd WatchPaths. Look here for lots of tips on launchd as well as hundreds of tutorials, a good wikipedia article and the Apple dev docs.

fseventsd will log some changes - so you might use FSeventer or access those files if launchd isn't your cup of tea.

fs_usage and lsof are process aware command line tool to tap into the IO subsystem as it's running. The fs_usage buffer can get overloaded so if you want something more guaranteed and less of a "take a quick peek" it's less dependable for total correct results as the other commands.

answered May 18 '11 at 14:07
Image (Asset 7/12) alt=
I have used FSEventer quite a few times to find out what an application is accessing. This is great when looking for license files for system imaging for lab deployment. – Digitalchild May 18 '11 at 23:36
fseventer is excellent to have the big picture realtime, you really see what's going!. – ling Sep 19 at 5:21

No one has mentioned Activity Monitor, found in the /Applications/Utilities folder.

Click on the Process Name in the list, then hit the "Inspect" button on the toolbar.

There are three tabs in the resulting window: Memory, Statistics, Open Files and Ports. The Open Files and Ports tab will show all the open files being used by the process.

answered May 18 '11 at 19:55
Image (Asset 9/12) alt=


command on the Terminal.app can do that for you? use the man lsof to catch up with it's use. Cheers

answered May 18 '11 at 14:09
Image (Asset 10/12) alt=

The faster way is:

$ lsof [path_to_file]

This solution doesn't require the root password and gives you back the following, clear, result:

Finder     497  JR7   21r   REG    1,2   246223 33241712 image.jpg
QuickLook 1007  JR7  txt    REG    1,2   246223 33241712 image.jpg
answered Nov 1 '13 at 8:41
Image (Asset 11/12) alt=

There's a graphical interface to lsof type information. It's donationware from HAMSoft and it's called What's Keeping Me. Designed to answer that "Why can't I delete this from my trash?" question that comes up every so often on OS X, it also happens to be a handy way to watch for open I/O handles on running processes if you're just curious about what's going on. It allows you some simple search and filtering.

answered May 18 '11 at 18:33
Image (Asset 12/12) alt=
Ian C.

Also available are iosnoop and iotop depending on your specific needs. These terminal commands can be piped through grep to watch for filesystem events from a specific process or against a specific file.

answered Jul 5 at 15:59

Your Answer


4 years ago


31764 times


1 month ago

Hot Network Questions

Technology Life / Arts Culture / Recreation Science Other
  1. Stack Overflow
  2. Server Fault
  3. Super User
  4. Web Applications
  5. Ask Ubuntu
  6. Webmasters
  7. Game Development
  8. TeX - LaTeX
  1. Programmers
  2. Unix & Linux
  3. Ask Different (Apple)
  4. WordPress Development
  5. Geographic Information Systems
  6. Electrical Engineering
  7. Android Enthusiasts
  8. Information Security
  1. Database Administrators
  2. Drupal Answers
  3. SharePoint
  4. User Experience
  5. Mathematica
  6. Salesforce
  7. ExpressionEngine® Answers
  8. more (13)
  1. Photography
  2. Science Fiction & Fantasy
  3. Graphic Design
  4. Movies & TV
  5. Seasoned Advice (cooking)
  6. Home Improvement
  7. Personal Finance & Money
  8. Academia
  9. more (9)
  1. English Language & Usage
  2. Skeptics
  3. Mi Yodeya (Judaism)
  4. Travel
  5. Christianity
  6. Arqade (gaming)
  7. Bicycles
  8. Role-playing Games
  9. more (21)
  1. Mathematics
  2. Cross Validated (stats)
  3. Theoretical Computer Science
  4. Physics
  5. MathOverflow
  6. Chemistry
  7. Biology
  8. more (5)
  1. Stack Apps
  2. Meta Stack Exchange
  3. Area 51
  4. Stack Overflow Careers
site design / logo © 2015 Stack Exchange Inc; user contributions licensed under cc by-sa 3.0 with attribution required
rev 2015.11.2.2924
Apple is a trademark of Apple Inc., registered in the US and other countries. This site is not affiliated with or endorsed by Apple Inc. in any way.