tldr/pages/osx/opensnoop.md

opensnoop

Tool that tracks file opens on your system. More information: https://ss64.com/osx/opensnoop.html.

• Print all file opens as they occur:

sudo opensnoop

• Track all file opens by a process by name:

sudo opensnoop -n "{{process_name}}"

• Track all file opens by a process by PID:

sudo opensnoop -p {{PID}}

• Track which processes open a specified file:

sudo opensnoop -f {{path/to/file}}