How to Use the opensnoop Command in macOS Terminal to Trace Real-Time File Access

Troubleshooting mysterious disk activity, identifying rogue background applications, or discovering which configuration files an app touches during launch can be challenging through standard Activity Monitor graphs. In macOS, Apple includes a collection of low-level diagnostic tools powered by the DTrace dynamic tracing framework. Among the most valuable is opensnoop, a real-time kernel tracking utility that logs every file opened across the operating system as it happens, reporting process IDs, application names, exact filesystem paths, and return error codes.

How opensnoop Intercepts Kernel System Calls

Rather than polling filesystem directories or reading historical log files, opensnoop operates dynamically at the kernel level:

• DTrace Kernel Probes: It hooks into the open(), open_nocancel(), and openat() system call entry points in the XNU Darwin kernel.
• Zero Pre-Indexing Overhead: It captures system calls instantaneously without maintaining a permanent background database or altering disk contents.
• Permission Isolation: Because inspecting system-wide kernel activity can reveal sensitive file paths, opensnoop requires administrative superuser (sudo) privileges to execute.

Basic Usage: Streaming All System File Activity

To start monitoring file open operations across all processes in real time:

sudo opensnoop

The terminal immediately begins streaming continuous tabular output:

Column Header	Data Reported	Diagnostic Utility
UID	User ID executing the process	Distinguishes root/system services (0) from standard user accounts (501).
PID	Process Identifier	Identifies the exact running process instance in memory.
COMM	Command / Binary Name	The executable triggering the file access (e.g. Safari, Finder, zsh).
FD	File Descriptor or Error Code	Positive integers represent successful file handles; -1 indicates access failure.
PATH	Absolute File Path	The full directory path to the file or socket being accessed.

Filtering Traces by Application Name or Process ID

Running an unconstrained trace produces a flood of output due to background system daemons. Filter your monitoring to target specific applications:

1. Filter by Process Name

# Trace only file activity initiated by Safari
sudo opensnoop -n Safari

# Trace activity from Visual Studio Code
sudo opensnoop -n Code

2. Filter by Process Identifier (PID)

# Obtain PID using pgrep
pgrep -x "Slack"

# Trace specific process ID
sudo opensnoop -p 14820

Tracing Failed File Access and Permission Denied Errors

When debugging application crashes or broken sandbox entitlements, filter specifically for failed system calls:

# Display only failed open attempts (where FD equals -1)
sudo opensnoop -e

This command immediately surfaces missing configuration files, broken dynamic library links, and permission-denied errors (such as EACCES or ENOENT) that prevent software from launching properly.

Handling System Integrity Protection (SIP) Restrictions

Because DTrace grants deep access into kernel memory, Apple’s System Integrity Protection (SIP) governs its operation on modern macOS versions:

• On standard macOS installations, opensnoop traces all user-space processes and third-party applications without issues.
• If an application is protected by Apple internal system entitlements (such as core system binaries located in /System/Library/CoreServices), DTrace restricts probing those specific protected binaries unless SIP DTrace restrictions are explicitly configured in macOS Recovery mode.