
The opensnoop utility is an amazing tool for tracking down specifics like what files specific applications are accessing, but you can also use opensnoop to monitor all filesystem access in Mac OS X. To do this, run the utility with no flags attached:
sudo opensnoop
You’ll be asked for your root password, and then you’ll immediately be presented with a firehose of data showing everything that is going on within Mac OS X.
Wondering what all this information you’re seeing is? The colorized guide below shows you what you’ll be most interested in following: Purple is the Process ID, Blue is the Process Name, and Red is the File Path:

Generally, the most useful information to follow is the process name and path to the file the given process is accessing. You’ll find a correspondence to what processes are shown in opensnoop with what is in the activity monitor / task manager.
You can also follow a specific file and discover what is accessing it with:
sudo opensnoop -f /path/to/file
Or you can track anything that relates to a specific file or app by using grep. For instance, I want to follow everything having to do with Terminal app or files related to it:
sudo opensnoop | grep Terminal
We’ve showed you this before, but you can also track specific applications with either their process id, or app name:
sudo opensnoop -n Terminal
Unless you’re troubleshooting very vague problems or you just want to see what’s going on behind the scenes of Mac OS X via the command line, it’s a good idea to use opensnoop with some specifics so you’re not inundated with information.