Trace file reads and writes on os x? I have something running that is syncing two directories. I want to turn it off but cannot figure out what it is. El Capitan, if that matters.

Can someone provide a command or tool that will reliably show the pid (and ideally the command) for every file read and write operation?

I assume this is possible with something dtrace-based but have not been able to figure it out.

(Login items are empty for the relevant user.  Crontab is empty for both the relevant user and root.)

Thank you for your help.
You are looking for the fs_usage command, which will show any file-related activity either on the whole system or by file.

For starters, do

sudo fs_usage


From man fs_usage


  NAME
  
  fs_usage -- report system calls and page faults related to filesystem activity in real-time
  
  SYNOPSIS

fs_usage [-e] [-w] [-f mode] [-b] [-t seconds] [-R rawfile [-S start_time] [-E
         end_time]] [pid | cmd [pid | cmd] ...]

  
  DESCRIPTION
  
  The fs_usage utility presents an ongoing display of system call usage information per-
       taining to filesystem activity.  It requires root privileges due to the kernel tracing
       facility it uses to operate.  By default, the activity monitored includes all system
       processes except the running fs_usage process, Terminal, telnetd, sshd, rlogind, tcsh,
       csh and sh.  These defaults can be overridden such that output is limited to include or
       exclude a list of processes specified by the user.