28

Had a sysinternals tool (filemon) for that, but now I can find something similar for the mac.

I'm a developer and I basically want to debug "file not found" or "wrong permissions" errors.

slhck
  • 223,558
  • 70
  • 607
  • 592

4 Answers4

18

You can use lsof or fs_usage in Terminal. lsof can be quite powerful. If it's about a specific process, you can try sampling it in Activity Monitor.

For a GUI tool, my recommendation is fseventer:

enter image description here

enter image description here

enter image description here

More GUI-oriented utilities, which I haven't used:

FileMon

enter image description here

FS Spy

enter image description here

Gaff
  • 18,569
  • 15
  • 57
  • 68
phoebus
  • 3,921
  • 1
  • 18
  • 15
  • +1 very nice answer. Btw, I've just tried FileMon and the filtering doesn't seem to work, which makes it pretty useless. fseventer is very nice. – occulus Feb 27 '13 at 10:59
  • fseventer claims "10.10 Yosemite is classified as unsupported till further notice". is there an updated answer? are there new recommendations? – rafraf Jul 14 '15 at 09:55
5

Less visual

https://diigo.com/0xcp0 for highlights from Brendan's blog » Top 10 DTrace scripts for Mac OS X (2011-10-10).

More visual

For more modern operating systems that are incompatible with fseventer, there's Apple Xcode Instruments –

selecting the File Activity template

Instruments in the background, Terminal in front

– powerful, but (compared to fseventer) in some cases, Instruments may be too heavyweight.

Graham Perrin
  • 1,273
  • 7
  • 28
  • 67
3

For viewing what files are accessed in real time you can leverage fs_usage part of the FSEvents feature in Mac OS X or even dtrace itself.

Usage: sudo fs_usage [PID].

For more info, check out the man page

Chealion
  • 25,408
  • 8
  • 67
  • 75
  • fs_usage is my favorite. I wrote about it on my blog post @ http://mohit.io/blog/fs_usage-trace-file-system-calls-on-mac-os-x/ where I was stuck with Outlook that had hung and I wanted to know what it was doing on my Mac. – mohit Mar 20 '15 at 19:00
0

You can use the dtrace opensnoop script to identify failed opens (file not found and permission errors)

jlliagre
  • 13,899
  • 4
  • 31
  • 48