CODEWITHSUNDEEP
macosunixterminalauditlsof
JPC
JPC

Reputation: 8286

See what process is accessing a file in Mac OS X

Note: This quesiton is NOT show me which files are in use. The file is not currently in use. The file will be in use at some unknown point in the future. At that point, I want to know what process accessed the file.

I would like to be able to track a file and see which process is touching that file. Is that possible? I know that I can see the list of open processes in activity monitor but I think it's happening to quickly for me to see it. The reason for this is I'm using a framework and I think the system version of the framework is being used instead of the debug version and I'd like to see which process is touching it.

Upvotes: 114

Views: 96247

Answers (5)

bontoJR
bontoJR

Reputation: 7045

The faster way is:

$ lsof -r [path_to_file]

This solution doesn't require the root password and gives you back the following, clear, result:

COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
Finder     497  JR7   21r   REG    1,2   246223 33241712 image.jpg
QuickLook 1007  JR7  txt    REG    1,2   246223 33241712 image.jpg

The -r argument keeps the command alive and should log any new file touched by the process you want to track.

Upvotes: 24

Shaun
Shaun

Reputation: 1289

lsof will list open files, but it can be a bit awkward for momentary touches (eg, if the file isn't open when lsof runs, it doesn't show).

I think your best bet would be fernLightning's fseventer.app. It's "nagware", and allows you to watch (graphically) the fsevents API in real-time.

Upvotes: 96

spaceboy.cz
spaceboy.cz

Reputation: 1327

That's simple: sudo fs_usage | grep [path_to_file]

Upvotes: 121

cavalcade
cavalcade

Reputation: 1367

Another option is Sloth. It's a free, open source GUI for LSOF that others have mentioned.

Upvotes: 17

Michael Dautermann
Michael Dautermann

Reputation: 89509

But I spent 2 minutes Googling and found your answer here.

$ lsof | grep [whatever]

Where [whatever] is replaced with the filename you're looking for. With this, you can see which program is desperately holding onto your about-to-be-trashed file. Once you exit that program, your trash will empty.

Upvotes: 45

Related Questions