Discover What Apps or Processes are Interacting with a File in Mac OS X

Using the lsof command, we can find out exactly what process or application is using a specified file at that given moment. This is similar to the opensnoop command, but rather than watching the changes to a file over time, lsof can give us a snapshot of this very moment, which can be helpful for troubleshooting purposes.
lsof /path/to/filename
For an example, to see what is interacting with with /var/log/system.log we point it at that file:
$ lsof /var/log/system.log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
Console 84281 Will 8r REG 14,2 140239 71929128 /private/var/log/system.log
In this case the app using system.log is “Console”. Again, this is showing us a snapshot at the moment the lsof command was executed, but by using the previously mentioned opensnoop command instead you can follow what processes use that file in real time:
sudo opensnoop -f /var/log/system.log
The above would result in seeing something like this:
$ sudo opensnoop -f /var/log/system.log
Password:
UID PID COMM FD PATH
501 84358 cat 3 /var/log/system.log
501 45411 console 3 /var/log/system.log
0 15 syslogd 16 /var/log/system.log
In this case you are looking under “COMM” for the process names, or PID for the process id.
Remember that you can go the opposite way with opensnoop as well, and show all files an app is using by pointing the command at an application or process, rather than a file.








Occasionally through the standard iOS upgrade process, but most commonly when jailbreaking, the iPhone can reboot and get stuck on the Apple logo at boot. This basically looks like the “” against a white or black screen.




Ever wondered how to make a zip file in Mac OS X? We recently demonstrated how to 


