Using the command line tool ‘opensnoop’ you can track any Mac applications (or system process) usage of the file system. This is a very handy tool for administrators and troubleshooting! The simplest way to use it is as follows:
sudo opensnoop -n Safari
You can also track a specific file, and what is accessing it, like so:
sudo opensnoop -f /etc/hosts
Tracking a specific process is as simple as just specifying the process id:
sudo opensnoop -p PID
opensnoop will keep tracking the file until the process itself is ended, so just hit Control-C in the Terminal to stop opensnoop from running. In case you’re wondering, opensnoop is based on DTrace, a popular UNIX tool.