Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know what files a specific application is trying to access on my disk. I know that you can use fs_usage, but this outputs events from all applications. I know that you can target a single application, but only one that is already running. I want to detect all readfile-events an application is trying to do, ever since it is started. I don't want to miss out on any event.

How do you achieve this?

share|improve this question
up vote 1 down vote accepted

Perhaps one of the utilities in my answer to this other SuperUser question will be of help.

share|improve this answer
    
FileMon seems to have the functionalities I desire. Thanks. – quano Feb 6 '10 at 19:49

It's not true that fs_usage applies to running processes. You can leave the list empty, and it will track all, also future ones. So sudo fs_usage -w -f filesys | grep "myprogramname" | tee logfile and then start "myprogramname". When done, Ctrl+C and the logfile (and stdout) has all the info.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .