2

I want to know what files a specific application is trying to access on my disk. I know that you can use fs_usage, but this outputs events from all applications. I know that you can target a single application, but only one that is already running. I want to detect all readfile-events an application is trying to do, ever since it is started. I don't want to miss out on any event.

How do you achieve this?

ale
  • 3,410
quano
  • 153

2 Answers2

1

Perhaps one of the utilities in my answer to this other SuperUser question will be of help.

Community
  • 1
phoebus
  • 4,001
1

It's not true that fs_usage applies to running processes. You can leave the list empty, and it will track all, also future ones. So sudo fs_usage -w -f filesys | grep "myprogramname" | tee logfile and then start "myprogramname". When done, Ctrl+C and the logfile (and stdout) has all the info.

Henno
  • 669
  • 4
  • 5