Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to figure out what changes to disk an app does.. and it's very messy. I'd like a way to monitor my entire file system for a few seconds to know which files have been accessed and written to. I thought of checking the modified date.. but of course it takes ages to do that for every file... there must be a cleverer way!

share|improve this question
add comment

2 Answers 2

up vote 4 down vote accepted

Check out fs_usage (shows all filesystem activity), creatbyproc.d (just file creation), filebyproc.d (just file opens), opensnoop (similar, different format), and rwsnoop (reads and writes).

share|improve this answer
add comment

For Linux, you'd check into 'inotify'. Quick research indicates the same tech for OSX is called 'kqueue'. It hooks into the filesystem and fires when events happen.

As usual, IBM has an excellent article.

share|improve this answer
    
Might want to fix the link –  Mark Nov 12 '09 at 23:36
1  
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.