OS X: Can I track what files are being accessed on a disk? I have several external hard drives.  They're consumer drives which "go to sleep" (spin down) automatically when unused; I can't (and don't want to) run them 24x7.  I use them strictly for backup and long-term storage.  

Very often, I'll use some irrelevant feature of a program (like "Undo" in Microsoft Word on a doc that's on the main drive) -- the application will freeze, and I'll hear an external hard drive spin up.  (Or every single drive spin up, one at a time.)  Then the program will unfreeze.   The program does not seem to be bothered if I unmount the drives; it simply stops doing that. 

And I am wondering: What on earth is it looking for?  So I can figure out how to stop this annoyance.  For instance if it's tapping fonts it found on the external drive, I can make sure they're inaccessible inside ZIP files. 

My question is: How can I have a persistent log of accesses to files by applications? I've tried using lsof | grep /Volumes/ but it is only a snapshot of currently open files; it always seems to miss the moment when that app has that file open.



I tried the fs_usage approach, got bursts of this message: fs-usage: buffer overrun, events generated too quickly: 123456  But eventually this surfaced: 

23:32:47  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000006   Microsoft Ex
23:32:47  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000002   Microsoft Ex
23:32:59  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000005   Microsoft Ex
23:32:59  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000002   Microsoft Ex
23:32:59  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000003   Microsoft Ex
23:32:59  getattrlist       /Volumes/Teeny/RSreorg                                                         0.000002   Microsoft Ex


This happened as I was closing an Excel spreadsheet.  That's a scratchpad disk, and that directory was deleted years ago. The spreadsheet was a new file that had nothing to do with that location.

Searching the drive for the text string RSreorg revealed only 2 files, both ~/Library/Preferences/com.microsoft.office.plist, one with gibberish at the end (temporary file?)... Web search reveals Microsoft stores my license keys there, but text scan reveals hundreds of other useless and wrong directories.  What on earth is Microsoft doing?

And apparently this answer endorses deleting the file outright.
You can use fs_usage to see all system calls related to filesystem activities. Output is quite large, so you probably need to redirect it to a file


Run sudo fs_usage &gt; fs.out in Terminal
Start Word and wait for the external drive to spin up
Switch to Terminal, press Ctrl-C and look through fs.out


You can also limit the output to certain processes, see the man page for details on that.