View Full Version : Utility for filesystem access tracking?

28th February 2007, 06:04 PM
Is there a utility for OSX that will show you what files each process has open and/or what files they have accessed?

28th February 2007, 06:48 PM
run lsof in terminal
might be overkill but its a start

28th February 2007, 07:19 PM
There's also fs_usage (again, in the terminal).

1st March 2007, 10:48 AM
There's also fs_usage (again, in the terminal).
Perfect! Thanks a million.

Now I should write a Cocoa app as a wrapper for fs_usage! (I wanted this for some hacking detective work to find out what files are being accessed by various system utilities)

1st March 2007, 11:33 AM
Is http://www.sveinbjorn.org/sloth what you are looking for?


1st March 2007, 01:18 PM
Graphically observe filesystem changes using the same underlying API as Spotlight. One example of use could be to determine what files are changed via software installation, preferences, etc...


It has a CLI counterpart as well. Go to the "More Information" page.


1st March 2007, 10:50 PM
Spectre, you are a legend. fseventer is now my favourite OSX hacking tool. Thank you so very much, that is exactly what I was after.

froggy, Sloth looks.... powerful, but seriously lacking in refinement. I assume it is basically a Cocoa GUI for lsof coupled with grep. That's not really all that useful. As an example, I spend 2 minutes dicking around before I realised that the search field was case sensitive - even then I couldn't find any useful info.

edit: fseventer even has drag and drop for events - so I can e.g. change a system pref, then drag the event associated onto TextMate (which can open root-owned system files) and edit and view it there. This is hacking, mac style!