Filesystem usage (process/pathname) Requires root privileges due to the kernel tracing facility it uses to operate.
Syntax fs_usage [-e] [-w] [-f mode] [pid|cmd [pid|cmd] ...] Options -e Generate output that excludes the running fs_usage tool. If a list of process ids or commands is also given, then those are also excluded. -w Force a wider, more detailed output, regardless of the window size. -f Turn on output filtering based on the mode provided. By default no filtering occurs. The supported modes are: network Only network related output is displayed. filesys Only file system related output is displayed.
the activity monitored includes all system processes except the running
fs_usage process, Terminal, telnetd, sshd, rlogind, tcsh, csh and sh.
These defaults can be overridden such that output is limited to include or exclude a list of processes specified by the user.
Monitor all filesystem activity:
$ sudo fs_usage
[then ctrl-C to cancel]
Watch iTunes manipulate files:
$ sudo fs_usage iTunes
TIMESTAMP TOD when call occurred. Wide mode will have millisecond granularity.
CALL The name of the network or filesystem related call, page-in, page-out or physical disk access.
Of the form F=x, x is a file descriptor. Depending on the type of system call, this will be either an input value or a return
Of the form B=x, x is the number of bytes requested by the call.
On error, the errno is displayed in brackets.
Pathname of the file accessed (up to the last 28 bytes).
Of the form A=0xnnnnnnnn, where 0xnnnnnnnn is the address being faulted.
DISK BLOCK NUMBER
Of the form D=0xnnnnnnnn, where 0xnnnnnnnn is the block number of the physical disk block being read or written.
OFFSET Of the form O=0xnnnnnnnn, where 0xnnnnnnnn is a file offset.
Of the form S=x, x is the number of ready descriptors returned by the select() system call. If S=0, the time limit expired.
The elapsed time spent in the system call. A `W' after the elapsed time indicates the process was scheduled out during this
file activity. In this case, the elapsed time includes the wait time.
The process that made the system call.
"Whom the gods love dies young" ~ Menander 300 BC
fs_usage man page - Apple.com
ps - List running processes (returns PID)
top - List running processes
sc_usage, latency, dyld