Mac OS X 10.5.2

Since switching to a Mac in January of 2008, I've been looking for a replacement of the Sysinternals tools, especially FileMon. For those who don't know, FileMon is a program which shows file activity in real-time (file accesses, changes). I found a utility on the Mac that is almost the same: fseventer. The only thing fseventer lacks is the ability to print file accesses--it only prints file/directory changes. If you need to be able to see file accesses, it seems the only solution on the Mac is to use Instruments, which is a program included with the free Developer Tools (XCode, Interface Builder, Shark, etc.) If you have Leopard and have some experience with dtrace(1), then you can use that utility from the command line. For 10.4, you can look at ktrace(1), but that utility shows system calls, not file accesses/modifications.



Download fseventer