Discover What Apps or Processes are Interacting with a File in Mac OS X

Jan 13, 2012 - 3 Comments

Watch what apps are using a file with lsof or opensnoop

Using the lsof command, we can find out exactly what process or application is using a specified file at that given moment. This is similar to the opensnoop command, but rather than watching the changes to a file over time, lsof can give us a snapshot of this very moment, which can be helpful for troubleshooting purposes.

lsof /path/to/filename

For an example, to see what is interacting with with /var/log/system.log we point it at that file:

$ lsof /var/log/system.log
Console 84281 Will 8r REG 14,2 140239 71929128 /private/var/log/system.log

In this case the app using system.log is “Console”. Again, this is showing us a snapshot at the moment the lsof command was executed, but by using the previously mentioned opensnoop command instead you can follow what processes use that file in real time:

sudo opensnoop -f /var/log/system.log

The above would result in seeing something like this:
$ sudo opensnoop -f /var/log/system.log
501 84358 cat 3 /var/log/system.log
501 45411 console 3 /var/log/system.log
0 15 syslogd 16 /var/log/system.log

In this case you are looking under “COMM” for the process names, or PID for the process id.

Remember that you can go the opposite way with opensnoop as well, and show all files an app is using by pointing the command at an application or process, rather than a file.

Enjoy this tip? Subscribe to the OSXDaily newsletter to get more of our great Apple tips, tricks, and important news delivered to your inbox! Enter your email address below:

Related articles:

Posted by: William Pearson in Command Line, Mac OS X, Tips & Tricks


» Comments RSS Feed

  1. bookofthedev says:

    Nice tip. If my hard disk is busy scrobbling away like hamsters in a shoe box, is there any way to find out which process is doing the dirty?

Leave a Reply


Shop for Apple & Mac Deals on

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates

Recent Posts