Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to know what files a specific application is trying to access on my disk. I know that you can use fs_usage, but this outputs events from all applications. I know that you can target a single application, but only one that is already running. I want to detect all readfile-events an application is trying to do, ever since it is started. I don't want to miss out on any event.

How do you achieve this?

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

Perhaps one of the utilities in my answer to this other SuperUser question will be of help.

share|improve this answer
    
FileMon seems to have the functionalities I desire. Thanks. –  quano Feb 6 '10 at 19:49
add comment

It's not true that fs_usage applies to running processes. You can leave the list empty, and it will track all, also future ones. So sudo fs_usage -w -f filesys | grep "myprogramname" | tee logfile and then start "myprogramname". When done, Ctrl+C and the logfile (and stdout) has all the info.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.