Discover What Apps or Processes are Interacting with a File in Mac OS X
Using the lsof command, we can find out exactly what process or application is using a specified file at that given moment. This is similar to the opensnoop command, but rather than watching the changes to a file over time, lsof can give us a snapshot of this very moment, which can be helpful for troubleshooting purposes.
For an example, to see what is interacting with with /var/log/system.log we point it at that file:
$ lsof /var/log/system.log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
Console 84281 Will 8r REG 14,2 140239 71929128 /private/var/log/system.log
In this case the app using system.log is “Console”. Again, this is showing us a snapshot at the moment the lsof command was executed, but by using the previously mentioned opensnoop command instead you can follow what processes use that file in real time:
sudo opensnoop -f /var/log/system.log
The above would result in seeing something like this:
$ sudo opensnoop -f /var/log/system.log
UID PID COMM FD PATH
501 84358 cat 3 /var/log/system.log
501 45411 console 3 /var/log/system.log
0 15 syslogd 16 /var/log/system.log
In this case you are looking under “COMM” for the process names, or PID for the process id.
Remember that you can go the opposite way with opensnoop as well, and show all files an app is using by pointing the command at an application or process, rather than a file.