`opensnoop` is an OSX command line utility that tracks file opens (Uses `DTrace`). As a process issues a file open, details such as UID, PID and pathname are printed out.
opensnoop tracks file opens. As a process issues a file open, details such as UID, PID and pathname are printed out. EXAMPLES # default output, print file opens by process as they occur $ sudo opensnoop # Print human readable timestamps $ sudo opensnoop -v # see error codes $ sudo opensnoop -e # snoop this file only $ sudo opensnoop -f /etc/passwd # snoop process id 1607 $ sudo opensnoop -p 1607 OPTIONS -a print all data -A dump all data, space delimited -c print current working directory of process -e print errno value -g print full command arguments -s print start time, us -v print start time, string -x only print failed opens -Z print zonename -f pathname file pathname to snoop -n name process name to snoop -p PID process ID to snoop opensnoop - OSX Man Pages <https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/opensnoop.1m.html>