fs_usage

Filesystem usage (process/pathname) Requires root privileges due to the kernel tracing facility it uses to operate.

Syntax
     fs_usage [-e] [-w] [-f mode] [pid|cmd [pid|cmd] ...]

Options
    -e     Generate output that excludes the running fs_usage tool.
           If a list of process ids or commands is also given, then
           those are also excluded.

    -w     Force a wider, more detailed output, regardless of the window size.

    -f     Turn on output filtering based on the mode provided.
           By default no filtering occurs. The supported
           modes are: network  Only network related output is displayed.
                      filesys  Only file system related output is displayed.

By default the activity monitored includes all system processes except the running fs_usage process, Terminal, telnetd, sshd, rlogind, tcsh, csh and sh.
These defaults can be overridden such that output is limited to include or exclude a list of processes specified by the user.

Examples

Monitor all filesystem activity:
$ sudo fs_usage
[then ctrl-C to cancel]

Watch iTunes manipulate files:
$ sudo fs_usage iTunes

Output columns:

TIMESTAMP TOD when call occurred. Wide mode will have millisecond granularity.

CALL The name of the network or filesystem related call, page-in, page-out or physical disk access.

FILE DESCRIPTOR
Of the form F=x, x is a file descriptor. Depending on the type of system call, this will be either an input value or a return
value.

BYTE COUNT
Of the form B=x, x is the number of bytes requested by the call.

[ERRNO]
On error, the errno is displayed in brackets.

PATHNAME
Pathname of the file accessed (up to the last 28 bytes).

FAULT ADDRESS
Of the form A=0xnnnnnnnn, where 0xnnnnnnnn is the address being faulted.

DISK BLOCK NUMBER
Of the form D=0xnnnnnnnn, where 0xnnnnnnnn is the block number of the physical disk block being read or written.

OFFSET Of the form O=0xnnnnnnnn, where 0xnnnnnnnn is a file offset.

SELECT RETURN
Of the form S=x, x is the number of ready descriptors returned by the select() system call. If S=0, the time limit expired.

TIME INTERVAL(W)
The elapsed time spent in the system call. A `W' after the elapsed time indicates the process was scheduled out during this
file activity. In this case, the elapsed time includes the wait time.

PROCESS NAME
The process that made the system call.

"Whom the gods love dies young" ~ Menander 300 BC

Related macOS commands:

ps - List running processes (returns PID)
top - List running processes
sc_usage, latency, dyld