From aa405d2f20f8f0fd67767200c414d934e2c41790 Mon Sep 17 00:00:00 2001 From: Felix Stein Date: Fri, 27 Oct 2017 06:03:43 +0200 Subject: [PATCH] opensnoop: add page (#1576) --- pages/osx/opensnoop.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 pages/osx/opensnoop.md diff --git a/pages/osx/opensnoop.md b/pages/osx/opensnoop.md new file mode 100644 index 0000000000..e54bfd5706 --- /dev/null +++ b/pages/osx/opensnoop.md @@ -0,0 +1,19 @@ +# opensnoop + +> Tool that tracks file opens on your system. + +- Print all file opens as they occur: + +`sudo opensnoop` + +- Track all file opens by a process by name: + +`sudo opensnoop -n {{process_name}}` + +- Track all file opens by a process by PID: + +`sudo opensnoop -p {{PID}}` + +- Track which processes open a specified file: + +`sudo opensnoop -f {{path/to/file}}`