110

Note: This quesiton is NOT show me which files are in use. The file is not currently in use. The file will be in use at some unknown point in the future. At that point, I want to know what process accessed the file.

I would like to be able to track a file and see which process is touching that file. Is that possible? I know that I can see the list of open processes in activity monitor but I think it's happening to quickly for me to see it. The reason for this is I'm using a framework and I think the system version of the framework is being used instead of the debug version and I'd like to see which process is touching it.

gman
  • 100,619
  • 31
  • 269
  • 393
JPC
  • 8,096
  • 22
  • 77
  • 110
  • 1
    this is a usage question better asked on [su] – Michael Dautermann Nov 29 '11 at 20:24
  • 2
    See http://apple.stackexchange.com/questions/14409/how-to-monitor-file-access-for-an-os-x-application – mmmmmm Mar 13 '13 at 18:50
  • 2
    NOTE: ^^^ IS A VERY RELEVANT, similar question - FYI ;-) – Brad Parks Mar 01 '16 at 02:25
  • lots of answers are missing the point of this question. The quesiton is not "show me files in use". The question is "show me files when they are accessed in the future". The accepted answer works. Most of the rest of the answers do not. – gman Aug 12 '22 at 19:53

5 Answers5

116

That's simple: sudo fs_usage | grep [path_to_file]

orkoden
  • 18,946
  • 4
  • 59
  • 50
spaceboy.cz
  • 1,269
  • 1
  • 7
  • 2
  • 13
    This is by far the best answer here. – NuSkooler Oct 03 '13 at 21:52
  • 1
    fs_usage should be runned as root... it's not the best solution. – bontoJR Nov 01 '13 at 08:36
  • 2
    This shows fs events? If a process has a file open but is not doing anything with it nothing shows up here. Or at least seemed to be my experience. `sudo fs_usage | grep musiclibrary` showed nothing but `sudo lsof | grep musiclibrary` showed 3 processes accessing my musiclibrary database files. – gman Jan 02 '20 at 10:09
97

lsof will list open files, but it can be a bit awkward for momentary touches (eg, if the file isn't open when lsof runs, it doesn't show).

I think your best bet would be fernLightning's fseventer.app. It's "nagware", and allows you to watch (graphically) the fsevents API in real-time.

agillgilla
  • 859
  • 1
  • 7
  • 22
Shaun
  • 1,281
  • 8
  • 6
  • 41
    `lsof | grep myfilename` worked for me. I've got a PDF file in my Trash that the system claims is in use. Weirdly `lsof` claims it's in use by `Preview` but `Preview` doesn't seem to be running (eg when I command-tab through the running apps) but `Activity Monitor` does show it to be running. Stupid Preview. – Dave Sag Aug 15 '12 at 01:27
  • This is perfect for transient files (i.e., files that aren't kept open but and only touched while saving). – Jeronimo Colon III Apr 05 '13 at 20:34
  • I had a similar problem today with a file in my Trash being held by a zombie Preview process. Opening Preview and quitting it again solved the issue for me. I think Preview regularly keep hold of files although it has quit. I often open images form Evernote in Preview in order to crop them, and most times - more often than not - even after I have quit Preview, Evernote wars that the image is still open in another application. – Vihung Feb 25 '14 at 14:07
  • This seems similar to a problem I'm having right now - still no solution. I downloaded a file using Chrome, then moved it using Finder to another folder. It showed up grey, so I used lsof to find out who had the file open: Finder. I tried force quitting Finder (which automatically relaunches it). That didn't work. I tried closing my laptop, figuring that would put everything to sleep and hopefully clearing the problem. That didn't work either. lsof continues to show Finder as the culprit, and it continues to show up grey in the UI. – Victor Engel Apr 12 '14 at 16:56
  • 1
    Interestingly, closing the finder windows seemed to solve the problem. However, if I opened up a new finder window and navigated to the same folder, the problem remained. I resolved the problem by dragging the errant file to the trash (producing a warning that there might be untoward effects in the program that has the file open), then recopying the file. – Victor Engel Apr 12 '14 at 17:03
  • Link is dead, it says `fernLightning.com is temporarily offline`, dated 31 July 2015. – Xiao Mar 15 '17 at 04:49
45

But I spent 2 minutes Googling and found your answer here.

$ lsof | grep [whatever]

Where [whatever] is replaced with the filename you're looking for. With this, you can see which program is desperately holding onto your about-to-be-trashed file. Once you exit that program, your trash will empty.

Michael Dautermann
  • 88,797
  • 17
  • 166
  • 215
22

The faster way is:

$ lsof -r [path_to_file]

This solution doesn't require the root password and gives you back the following, clear, result:

COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
Finder     497  JR7   21r   REG    1,2   246223 33241712 image.jpg
QuickLook 1007  JR7  txt    REG    1,2   246223 33241712 image.jpg

The -r argument keeps the command alive and should log any new file touched by the process you want to track.

bontoJR
  • 6,995
  • 1
  • 26
  • 40
  • 1
    this is not an answer the quesiton. The quesiton is not "show me files in use". The question is "show me files when they are accessed in the future" – gman Aug 12 '22 at 19:51
17

Another option is Sloth. It's a free, open source GUI for LSOF that others have mentioned.

cavalcade
  • 1,367
  • 14
  • 15
  • 1
    Wow this is a really great tool thanks for sharing! It worked perfect for finding a process I lost track of. – RayB Jul 20 '18 at 16:59
  • 2
    I tend to prefer command-line solutions because they are more portable, but I must admit this is a very nice tool! Thanks for the suggestion. – Form Aug 03 '18 at 16:09
  • This is like lsof on steroids, very nice – Malcolm Crum Nov 15 '21 at 19:56