Monitor Mac OS X Filesystem Usage & Access with opensnoop
The opensnoop utility is an amazing tool for tracking down specifics like what files specific applications are accessing, but you can also use opensnoop to monitor all filesystem access in Mac OS X. To do this, run the utility with no flags attached:
sudo opensnoop
You’ll be asked for your root password, and then you’ll immediately be presented with a firehose of data showing everything that is going on within Mac OS X.
Wondering what all this information you’re seeing is? The colorized guide below shows you what you’ll be most interested in following: Purple is the Process ID, Blue is the Process Name, and Red is the File Path:
Generally, the most useful information to follow is the process name and path to the file the given process is accessing. You’ll find a correspondence to what processes are shown in opensnoop with what is in the activity monitor / task manager.
You can also follow a specific file and discover what is accessing it with:
sudo opensnoop -f /path/to/file
Or you can track anything that relates to a specific file or app by using grep. For instance, I want to follow everything having to do with Terminal app or files related to it:
sudo opensnoop | grep Terminal
We’ve showed you this before, but you can also track specific applications with either their process id, or app name:
sudo opensnoop -n Terminal
Unless you’re troubleshooting very vague problems or you just want to see what’s going on behind the scenes of Mac OS X via the command line, it’s a good idea to use opensnoop with some specifics so you’re not inundated with information.
[…] what process or application is using a specified file at that given moment. This is similar to the opensnoop command, but rather than watching the changes to a file over time, lsof can give us a snapshot of this very […]
[…] Monitor Mac OS X Filesystem Usage & Access with opensnoop […]
[…] string to a friend of mine who is a novice computer user. Let’s say it’s a variation of lsof to monitor internet access of certain apps because it’s relatively short, but it could be anything and I typically use this for source […]
[…] Line, Tips & Tricks – April 29th, 2011 – Leave a Comment Much like you can monitor Mac OS X filesystem usage through the command line, you can also discover what apps are currently using your internet […]
“We’ve SHOWED you this before,”…?
The past participle of SHOW is SHOWN, not SHOWED. If you are professional writer, then this grammar error is unacceptable.
Strictly speaking that comma after writer is also unnecessary.
Stictly speaking, there should be a comma after the word ‘speaking’.
s/Stictly/Strictly/
…or in a Terminal just type ‘Top’
Isn’t this just lsof?
They are similar, but lsof gives you a snapshot where as opensnoop is continuously updated as a live stream according to filesystem access.
There may be a way to use lsof in a similar manner though.