`opensnoop` is an OSX command line utility that tracks file opens (Uses `DTrace`). As a process issues a file open, details such as UID, PID and pathname are printed out.

opensnoop tracks file opens. As a process issues a file open, details 
such as UID, PID and pathname are printed out.

EXAMPLES

# default output, print file opens by process as they occur
$ sudo opensnoop

# Print human readable timestamps
$ sudo opensnoop -v

# see error codes
$ sudo opensnoop -e

# snoop this file only
$ sudo opensnoop -f /etc/passwd

# snoop process id 1607
$ sudo opensnoop -p 1607

OPTIONS
    -a      print all data
    -A      dump all data, space delimited
    -c      print current working directory of process
    -e      print errno value
    -g      print full command arguments
    -s      print start time, us
    -v      print start time, string
    -x      only print failed opens
    -Z      print zonename
    
    -f pathname
            file pathname to snoop

    -n name
            process name to snoop

    -p PID 
            process ID to snoop

opensnoop - OSX Man Pages 
<https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/opensnoop.1m.html>