Question: I got an iMac 27″ with a dying hard drive. Sometimes I got hight read/write access to the hard drive and I don’t why.
Is there an program to monitor the access program specific? I want to know which program causes the high activities.
Answer: You can use the command-line application fs_usage to monitor disk use live. It requires elevated privileges.
Enter in Terminal:
sudo fs_usage
The only problem is, without filtering for applications, you probably won’t be able to read the output fast enough. To filter for specific applications:
sudo fs_usage Finder
It wants the internal application name that is also used e.g. in ps, not the name of the application bundle.
Another option is opensnoop: It only monitors file open activity and contains less noise than fs_usage but you need e.g. grep to filter the output.
It contains the numeric file descriptor returned from the file open call or -1 if it failed. This doesn’t have to indicate a real problem though: Many programs seem to open files (e.g. configuration files) speculatively, and if they don’t exist, fall back to defaults.
It also requires elevated (i.e. root) privileges:
sudo opensnoop
It’s ideal for answering questions like this one: Run opensnoop | grep plist to monitor all .plist configuration file changes, and change some settings in System Preferences to find out where they’re stored on disk.
You can also inspect the processes in /Applications/Utilities/Activity Monitor.app. Select a process in the list, then View ? Inspect Process ? Open Files and Ports.
You can also use fseventer, a GUI utility for monitoring file system changes.
(Thanks @Chealion!)