snoop file opens on Snow Leopard

Opensnoop tracks file opens.
sudo opensnoop

or you can watch only a process
sudo opensnoop -n Google Chrome

Monitoring file system activity on OS X

My hard disk is quite slow, so It seemed a good idea to see what's going on under the hood, why the filesystem is so busy.
I came across fslogger, which is a great user-space program that subscribes to the kernel's file system change notification service.

Sounds great and actually monitoring file system activity with fslogger is quite easy. It must be run as root but that's it.

The output is little bit verbose but you can cut it with awk.

# changed files
sudo fslogger | awk '/FSE_ARG_STRING/ { print $5 }'

# file change type
sudo fslogger | awk '/type.*=/ { print $3 }'

# process that caused the change
sudo fslogger | awk '/pid.*=.*\(.*\)/ { print $4$5 }'



Helpful.