Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know what files a specific application is trying to access on my disk. I know that you can use fs_usage, but this outputs events from all applications. I know that you can target a single application, but only one that is already running. I want to detect all readfile-events an application is trying to do, ever since it is started. I don't want to miss out on any event.

How do you achieve this?

share|improve this question
up vote 1 down vote accepted

Perhaps one of the utilities in my answer to this other SuperUser question will be of help.

share|improve this answer
FileMon seems to have the functionalities I desire. Thanks. – quano Feb 6 '10 at 19:49

It's not true that fs_usage applies to running processes. You can leave the list empty, and it will track all, also future ones. So sudo fs_usage -w -f filesys | grep "myprogramname" | tee logfile and then start "myprogramname". When done, Ctrl+C and the logfile (and stdout) has all the info.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.