One of the more advanced tools that’s nice to have in your arsenal of “what to do if things go wrong” is a Terminal command called fs_usage. This will show you what your file system is doing at any particular time, and it’s pretty helpful if you’re trying to do some fancy power-user troubleshooting. Here’s how you use it and what options you have to do so. This’ll be a technical tip, but I have faith that we all can handle that.
So first, open Terminal (it lives in the Applications > Utilities folder). Then type in the following and hit enter:
sudo fs_usage
After you do so, you’ll be prompted to type in your administrator password. You won’t see any on-screen evidence that you’re typing, but trust me, it’s paying attention to you. Again, you’ll hit enter when you’re done.
Zoinks! A whole truckload of information will start scrolling by, and unless you’re some kind of developer god, most of it will probably look like gobbledygook. Drag the window out larger if you’d like to see more at once, or you can hit Command-period to stop the output at any time and scroll through what’s already passed you by.
Here’s what your Terminal window will look like:
You’ll note the information is organized into columns. Unless you’re one of the aforementioned developers, you probably won’t need to pay attention to most of that data, but it’s useful to know what a few of the columns are. The first one shows you the time that the event happened:
The sixth column will reveal the path name for the accessed file, if any:
The last column shows the process responsible:
Don’t understand what a process is? Don’t worry about it. Just try to think of them as tasks that your Mac is running, some of which are obvious (like Mail) and some of which are not so familiar and run in the background (like Spotlight’s mdworker process). If you’re trying to figure out what a particular process is doing there, a Web search for its name is a good way to become enlightened.
The fs_usage command has been very helpful to me in the past. For example, I was once troubleshooting someone’s copy of Microsoft Word that refused to open. I trashed every preference file I could think of with no success, and I was feeling not so friendly toward both Microsoft and the universe. So I started fs_usage running, attempted to open Word, and then went back to the Terminal window and stopped the command. Then I sifted through the output to find the particular corrupted file that had been accessed, deleted it, and all was right with the world. Granted, I could’ve reinstalled the software if I’d wanted to, but this was a much faster way to solve the issue.
Here are a few options available for fs_usage that you may find to be useful in your troubleshooting:
sudo fs_usage -f network
Filters the results to show you only network-related events.
sudo fs_usage -w
Changes the output so that it’s not dependent on your window size (necessary if you have long path names you’re looking at).
sudo fs_usage [process name]
Shows only results that contain the specified process. If you’re familiar with how to find process names, go you! If not, an easy way to do so is to open Activity Monitor (within Applications > Utilities) and check out the “Process Name” column.
Anything within that can be searched for, but make sure you type it exactly (including matching the capitalization). Here’s an example:
sudo fs_usage mdworker
sudo fs_usage pid [process ID]
As with the command directly above, you can use Activity Monitor to find out the process ID for what you’re looking for (it’s the first column, labeled “PID”). Use it in this command to exclude everything from the output that doesn’t match, as follows:
sudo fs_usage pid 162
sudo fs_usage | grep [any search term]
This command takes the output of fs_usage and uses a separate command, grep, to only include lines that match the search term you’ve typed in (which means you can search for any text string from any column). For you advanced Terminal users, remember that if your search includes more than one word, you have to escape the spaces by using backslashes or quotation marks.
sudo fs_usage | grep Library
sudo fs_usage | grep "Activity Monitor"
sudo fs_usage | grep Activity\ Monitor
If you’re curious, here’s an online version of the fs_usage manual page, which will give you tons more information than I have room to talk about in this tip. Or for a completely up-to-date manual, type man fs_usage into the Terminal. Use the spacebar to advance to the next page, and hit Q to exit.
There! We got through it, didn’t we? And only about 75 percent of you have fallen asleep. I consider that a win.