Skip to main content

How to find what all files are accessed by an application or vice versa

"Opensnoop" command helps in file system monitoring activities ex if we want to know what all files are accessed by an application or which all processes access a particular file then opensnoop will help you in that activity.

Ex 1:

Let us say if we want to know what all files are accessed by firefox in its operation time on mac os x then run opensnoop in sudo or root mode as below

sudo opensnoop -n firefox 


Note : We can even supply the process id (PID) of an application in place of the application name above by using the -p switch as "sudo opensnoop -p "

Ex 2 :

Let us say if we want to know what all process/applications are accessing a particular file then run the opensnoop command as

sudo opensnoop -f  /Users/user/Documents/Test.txt

Popular posts from this blog

How to find firmware or boot ROM version in Mac OS X

Firmware and boot ROM version of your mac can be found in two ways.
Way 1 :
1. From "Apple" menu , choose "About This Mac" menu item. 2. Click " More Info " to open "System Profiler" application. 3. Under Contents -> Select Hardware Tree item.
On the right side panel Under hardware overview section, we can see Boot ROM Version and SMC (Firmware) Version.








Way 2 :
Run the below command in terminal to get boot ROM version and SMC(firmware) version :
$ system_profiler SPHardwareDataType | grep -i "Version" | awk -F ':' '{print $1 $2}'

How to disable USB ports on Mac OS X Mavericks, Yosemite or El Capitan ?

We might wonder how to disable the USB ports on Mac to prevent data copy to external USB mass storage devices. The USB kext on os x is loaded at the time of start of the system, this can be loaded / unloaded using kextload or kextunload command. To disable USB port on Mac , follow below steps:
On Macs running Mountain Lion, Mavericks  and Yosemite:
Unmount any connected USB devices to the system by running below command                  $diskutil unmount /Volumes/USBDISK.Now unload the USB related kernel extensions in the following order using kextunload command.sudo kextunload -b com.apple.driver.AppleUSBCardReader
sudo kextunload -b com.apple.driver.AppleUSBODD
sudo kextunload -b com.apple.iokit.IOUSBMassStorageClass

       This will unload the USB kext and disable the USB ports for storage devices on Mountain Lion, Mavericks  and Yosemite.
On Mac running El Capitan:
Unmount any connected USB devices to the system by running below command                  $diskutil unmount /Volumes/USBDI…