Discover What Apps or Processes are Interacting with a File in Mac OS X

Using the lsof command, we can find out exactly what process or application is using a specified file at that given moment. This is similar to the opensnoop command, but rather than watching the changes to a file over time, lsof can give us a snapshot of this very moment, which can be helpful for troubleshooting purposes.

lsof /path/to/filename

For an example, to see what is interacting with with /var/log/system.log we point it at that file:

$ lsof /var/log/system.log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
Console 84281 Will 8r REG 14,2 140239 71929128 /private/var/log/system.log

In this case the app using system.log is “Console”. Again, this is showing us a snapshot at the moment the lsof command was executed, but by using the previously mentioned opensnoop command instead you can follow what processes use that file in real time:

sudo opensnoop -f /var/log/system.log

The above would result in seeing something like this:
$ sudo opensnoop -f /var/log/system.log
Password:
UID PID COMM FD PATH
501 84358 cat 3 /var/log/system.log
501 45411 console 3 /var/log/system.log
0 15 syslogd 16 /var/log/system.log

In this case you are looking under “COMM” for the process names, or PID for the process id.

Remember that you can go the opposite way with opensnoop as well, and show all files an app is using by pointing the command at an application or process, rather than a file.