Question

I remember having a command line tool on an older Mac OS X version (Tiger?) that told me the name of every file that was written to (or read) by any process on the system. It used fseventd (? or something like that). Is there something like that for the newest Mac OS X (10.6)? It should be run in a terminal window and then I can use the system as normal. Let’s say I type cat /etc/passwd, the output of that program would be similar to

/bin/cat
/etc/passwd

I can’t use lsof because I can’t get the timing right.

Is this clear or do you need more information?

Answer 1

Run fs_usage as root.