Trace file reads and writes on os x?

Solution 1:

You are looking for the fs_usage command, which will show any file-related activity either on the whole system or by file.

For starters, do

sudo fs_usage

From man fs_usage

NAME

fs_usage -- report system calls and page faults related to filesystem activity in real-time

SYNOPSIS

fs_usage [-e] [-w] [-f mode] [-b] [-t seconds] [-R rawfile [-S start_time] [-E
         end_time]] [pid | cmd [pid | cmd] ...]

DESCRIPTION

The fs_usage utility presents an ongoing display of system call usage information per- taining to filesystem activity. It requires root privileges due to the kernel tracing facility it uses to operate. By default, the activity monitored includes all system processes except the running fs_usage process, Terminal, telnetd, sshd, rlogind, tcsh, csh and sh. These defaults can be overridden such that output is limited to include or exclude a list of processes specified by the user.