MacOS X comes with great command line programs for debugging and troubleshooting various issues with your system. If you ever need to check what program is accessing your disk, use these three programs: iosnoop, fs_usage and iotop.

All require the sudo password, as they tap deep into your kernel to get the information.

The first one, iosnoop, monitors the disk I/O displaying the information line by line as it happens in real-time. Think of it as the tcpdump command for your disk operations. To run it, type the following in your Terminal window:

sudo iosnoop -v -a

The “-v” adds a timestamp to each line and the “-a” prints additional information such as device major and minor numbers, as well as program arguments for the process. If you want to monitor a particular volume or a filesystem, specify it with the “-m” switch:

sudo iosnoop -v -a -m /

The second one, fs_usage, gives a more in-depth information, showing if the information was read or written from/to a disk or sent or received over the network. Similarly to iosnoop, it runs in real-time, displaying rows of events as they happen.

To display all the info, type the following into your Terminal window:

sudo fs_usage -w

To limit the output to the network events only, use this:

sudo fs_usage -w -f network

To limit the output to a particular application’s network traffic, add its name to the end:

sudo fs_usage -w -f network Dropbox

You can also monitor the application’s disk I/O only:

sudo fs_usage -w -f filesys Dropbox

The man page for fs_usage refers to the “-w” switch as the wide format display, however visually the output it generates looks narrower and more readable compared to the default mode.

The third program, iotop, monitors the disk I/O displaying a list of programs that use the disk the most. Think of it as the top command, but for your disk I/O. The iosnoop will run forever until Control – C is hit, or the specified interval is reached.

To run it with 1 second delay, type the following in your Terminal window:

sudo iotop 1

To run it for 1 minute with 6 10 second intervals, type the following:

sudo iotop 6 10

As always, the man pages contain additional information about these programs. I encourage you to study them well for more switches and options before looking elsewhere for your I/O monitoring needs.