How to Use the macOS fs_usage Command to Monitor Disk Activity

When your Mac’s cooling fans suddenly spin up and the system becomes unresponsive, the culprit is often a runaway process aggressively reading or writing to the solid-state drive (SSD). While the graphical Activity Monitor can show you which application is using the most disk bandwidth, it cannot tell you exactly what that application is doing. If a process is stuck in an infinite loop, continuously trying to read a broken cache file or write to a locked directory, you need a lower-level diagnostic tool. To see the exact, real-time filesystem calls made by every process on the system, macOS administrators use the fs_usage command.

Why Use the fs_usage Command?

The fs_usage (file system usage) command is a diagnostic tool that hooks directly into the macOS kernel. It acts as a live wiretap on your hard drive, intercepting and printing every single file system operation (such as open, read, write, and stat) as it happens. This allows you to watch exactly which specific files an application is touching, down to the microsecond. It is invaluable for diagnosing \”spinning beachball\” hangs, identifying aggressive background indexing services (like Spotlight), or tracking down malware that is secretly exfiltrating data.

Step 1: Run a Basic Live Trace

Because fs_usage hooks into the kernel, it requires absolute root privileges to execute.

1. Open the macOS Terminal.
2. Type the command preceded by sudo, and press Enter:

sudo fs_usage

Be prepared: the terminal will instantly flood with data. Thousands of lines will scroll past every second, detailing the timestamp, the system call, the exact file path being accessed, the byte count, and the name of the process responsible. Press Ctrl + C to stop the trace and freeze the output so you can read it.

Step 2: Filter by a Specific Process

A raw trace is usually too noisy to read. If you already know which application is misbehaving (e.g., Google Chrome), you can force fs_usage to ignore everything else.

1. Run the command followed by the name of the process:

sudo fs_usage Google\\ Chrome

Now, the output will only stream filesystem events generated by Chrome, allowing you to clearly see if it is constantly hitting a specific cache file or database.

Step 3: Filter by File Operations

Sometimes you care more about the action than the application. For example, if you suspect your SSD is being worn out by excessive writes, you can filter the trace to show only file modifications.

1. Use the -f (filter) flag followed by the filesys keyword:

sudo fs_usage -f filesys

This filters out network socket activity (which fs_usage also captures by default) and focuses strictly on physical disk reads, writes, and opens.

Step 4: Output to a Log File

Because the data moves too quickly to read live, professional administrators typically dump the output into a text file for later analysis using grep.

1. Use standard command-line redirection (>) to save the trace:

sudo fs_usage -t 10 > ~/Desktop/disk_trace.txt

(Note: The -t 10 flag tells the command to only run for exactly 10 seconds before stopping automatically, preventing it from generating a multi-gigabyte text file).

By utilizing the fs_usage command, macOS power users can look past the GUI and mathematically observe exactly how applications interact with the physical storage layer.