Skip to main content

How to find what all files are accessed by an application or vice versa

"Opensnoop" command helps in file system monitoring activities ex if we want to know what all files are accessed by an application or which all processes access a particular file then opensnoop will help you in that activity.

Ex 1:

Let us say if we want to know what all files are accessed by firefox in its operation time on mac os x then run opensnoop in sudo or root mode as below

sudo opensnoop -n firefox 


Note : We can even supply the process id (PID) of an application in place of the application name above by using the -p switch as "sudo opensnoop -p "

Ex 2 :

Let us say if we want to know what all process/applications are accessing a particular file then run the opensnoop command as

sudo opensnoop -f  /Users/user/Documents/Test.txt

Popular posts from this blog

How to find firmware or boot ROM version in Mac OS X

Firmware and boot ROM version of your mac can be found in two ways.
Way 1 :
1. From "Apple" menu , choose "About This Mac" menu item. 2. Click " More Info " to open "System Profiler" application. 3. Under Contents -> Select Hardware Tree item.
On the right side panel Under hardware overview section, we can see Boot ROM Version and SMC (Firmware) Version.








Way 2 :
Run the below command in terminal to get boot ROM version and SMC(firmware) version :
$ system_profiler SPHardwareDataType | grep -i "Version" | awk -F ':' '{print $1 $2}'

How to boot into recovery mode on mac without holding Command + R Key on keyboard ?

Generally well known method to boot the mac into recovery mode is by holding the Command + R on keyboard while mac is turned on. However you can force the mac to boot into recovery mode upon next reboot by changing the nvram setting. To do that, Run below command.  

sudo nvram "recovery-boot-mode=unused" sudo reboot