Trace Real-Time Filesystem Activity with fs_usage

Watch every open, write, and stat call happening on your disks and see exactly which process made it.

macOSfs_usagefilesystemdtracetroubleshootingMedium risk

Run `sudo fs_usage -w -f filesys` to stream all filesystem syscalls with the responsible process on each line.

01Command

Command

$ sudo fs_usage -w -f filesys | grep -i Documents

02What it does

fs_usage is Apple's DTrace-backed syscall tracer built for filesystem events, so it answers 'what keeps writing to this folder' far better than any activity monitor. The -w flag widens lines so long paths aren't truncated, and -f filesys limits output to filesystem traffic (use -f network for sockets). Pipe through grep for a specific path, or pass a PID to focus on one process.

03Risk

RiskMedium risk

Requirementssudo required; SIP limits tracing Apple system binaries.

!Warning: SIP prevents tracing most Apple system processes; third-party apps trace fine.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

macOS fs_usage — report system calls and page faults related to filesystem activity
SS64 · technical · 2026-09-17
Evidence: Documents fs_usage's filesys filter, -w wide output and -f filter classes.

Last verified: 2026-09-17 · Category: System & Settings

06Related solutions

Search the Unified Log with log show

macOSlogtroubleshootinglogging

Filter macOS's single unified log by process, message type, or subsystem straight from the Terminal.

Low risk ✓ 2026-09-17