How to Use the macOS fs_usage Command to Monitor Real-Time Filesystem Activity

When a Mac experiences unexpected disk thrashing, high I/O latency, or mystery background processes consuming drive resources, diagnosing the root cause can be difficult. Standard activity monitors show overall usage but do not reveal exactly which files are being touched. To gain deep, real-time visibility into every single read, write, and open operation happening on your drive, systems administrators use the macOS fs_usage command.

Why Use the fs_usage Command?

The fs_usage command hooks directly into the macOS kernel to monitor file system and network events in real-time. It streams a highly detailed log of every system call related to the disk, identifying the exact process name, the specific file path being accessed, the type of operation (e.g., read, write, stat), and the elapsed time. This makes it the ultimate tool for hunting down runaway processes, caching bugs, or aggressive indexing daemons.

Step 1: Launch fs_usage

Because fs_usage intercepts kernel-level events, it requires root privileges to execute.

1. Open the macOS Terminal application.
2. Type the following command and press Enter:

sudo fs_usage

1. Enter your administrator password.
2. The terminal will immediately begin scrolling rapidly with thousands of events per second, reflecting the massive amount of background I/O happening on a modern operating system.
3. Press Ctrl + C to stop the output.

Step 2: Filter by a Specific Process

Streaming all system activity is usually too overwhelming. The true power of fs_usage comes from filtering the output. If you suspect the Safari browser is thrashing your disk, you can restrict the output to only show Safari’s activity.

1. Run the command followed by the name of the process:

sudo fs_usage Safari

Now, the terminal will only display file system events triggered directly by the Safari process, allowing you to clearly see which cache files or databases it is modifying.

Step 3: Filter Out Background Noise

Conversely, you might want to see general system activity but exclude noisy background services like Spotlight indexing (mds) to find a hidden rogue process.

1. Use the -e flag to exclude a specific process from the stream:

sudo fs_usage -e mds

Step 4: Focus Only on File Operations

By default, fs_usage also logs network-related system calls. If you only care about disk I/O, you can force the tool to ignore network activity.

1. Use the -f filesys flag:

sudo fs_usage -f filesys

By mastering the fs_usage command, macOS power users can look beneath the graphical interface and precisely identify exactly how applications are interacting with their storage drives.