Monitor Mac OS X Filesystem Usage & Access with opensnoop

Apr 22, 2011 - 11 Comments

Monitor Mac OS X Filesystem Use and Access

The opensnoop utility is an amazing tool for tracking down specifics like what files specific applications are accessing, but you can also use opensnoop to monitor all filesystem access in Mac OS X. To do this, run the utility with no flags attached:

sudo opensnoop

You’ll be asked for your root password, and then you’ll immediately be presented with a firehose of data showing everything that is going on within Mac OS X.

Wondering what all this information you’re seeing is? The colorized guide below shows you what you’ll be most interested in following: Purple is the Process ID, Blue is the Process Name, and Red is the File Path:

reading opensnoop firehose data

Generally, the most useful information to follow is the process name and path to the file the given process is accessing. You’ll find a correspondence to what processes are shown in opensnoop with what is in the activity monitor / task manager.

You can also follow a specific file and discover what is accessing it with:

sudo opensnoop -f /path/to/file

Or you can track anything that relates to a specific file or app by using grep. For instance, I want to follow everything having to do with Terminal app or files related to it:

sudo opensnoop | grep Terminal

We’ve showed you this before, but you can also track specific applications with either their process id, or app name:

sudo opensnoop -n Terminal

Unless you’re troubleshooting very vague problems or you just want to see what’s going on behind the scenes of Mac OS X via the command line, it’s a good idea to use opensnoop with some specifics so you’re not inundated with information.


Related articles:

Posted by: David Mendez in Command Line, Mac OS, Tips & Tricks


» Comments RSS Feed

  1. […] what process or application is using a specified file at that given moment. This is similar to the opensnoop command, but rather than watching the changes to a file over time, lsof can give us a snapshot of this very […]

  2. […] Monitor Mac OS X Filesystem Usage & Access with opensnoop […]

  3. […] string to a friend of mine who is a novice computer user. Let’s say it’s a variation of lsof to monitor internet access of certain apps because it’s relatively short, but it could be anything and I typically use this for source […]

  4. […] Line, Tips & Tricks – April 29th, 2011 – Leave a Comment Much like you can monitor Mac OS X filesystem usage through the command line, you can also discover what apps are currently using your internet […]

  5. riddletr says:

    “We’ve SHOWED you this before,”…?

    The past participle of SHOW is SHOWN, not SHOWED. If you are professional writer, then this grammar error is unacceptable.

  6. Bruce says:

    …or in a Terminal just type ‘Top’

  7. hpux735 says:

    Isn’t this just lsof?

    • David says:

      They are similar, but lsof gives you a snapshot where as opensnoop is continuously updated as a live stream according to filesystem access.

      There may be a way to use lsof in a similar manner though.

Leave a Reply


Shop on and help support OSXDaily!

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates

Tips & Tricks


iPhone / iPad



Shop on Amazon to help support this site