If you'd rather spend some of your time than your money on this, you can use the built-in fs_usage terminal command and filter its output (e.g. with grep). Works even with SIP enabled, but will then obviously only return information that SIP doesn't cover.

More info:

  man fs_usage

Example showing pathname-only events but otherwise unfiltered:

  sudo fs_usage -ew -f pathname

I used this incantation in the past to get the hottest file paths

  $ sudo fs_usage -w -t 5 -f filesys | tee fs_usage.log | egrep -o '(/.+?) {3}' | sed -e 's/\/dev\/disk[^ ]+  //' | sort | uniq -c | sort -nr

From https://www.jakobstoeck.de/2017/ramdisk-for-faster-applicati...

I'm going to start calling command line commands "incantations"

I think you might enjoy this poster then: https://www.reddit.com/r/linux/comments/ifmoua/ive_finally_f...

Have a look at the writings on the books, the pots, etc, in that picture and I think you will see what I mean ;)

You might have to open the picture on a laptop or desktop computer to get a good look at it. On mobile it might be more difficult to see it proper.

It’s my favorite poster that I have ever seen. One of these days I will get myself a nice physical copy of it.

I have a copy of that poster hanging on my wall!!

Even better!

And as (American?) English speakers tend to abbreviate almost everything ("app", "fridge" ...) we might end at "cantos" then.

https://en.wikipedia.org/wiki/Canto ... I'm currently reading Dan Simmons' Hyperion/Endymion again, which might have pushed that into my mind.

FSMonitor[0] is similar to the old FileMon[1] but for macOS.

In the default tree view, as new data is written, the entries are highlighted and sort of throb, so it's easy to track what's going on.

[0] https://fsmonitor.com/

[1] https://learn.microsoft.com/en-us/sysinternals/downloads/fil...

On Linux, this can be done using BPF (Berkley Packet Filter). In fact there is a tool in BCC[0] called filetop, which lists reads/writes by process and file[1].

0. https://github.com/iovisor/bcc

1. https://github.com/iovisor/bcc/blob/master/tools/filetop.py

Activity monitor shows what’s being written and the accumulative R/W by process. Wouldn’t be too hard to look at lsof and figure it out.

Happened to me this morning, something filled up my drive in minutes. I used dust[1] to look for large files while it was happening but knowing what was doing it would've been a big help.

[1] https://github.com/bootandy/dust

Not sure you can do that 100% of the time, since programs can write to unlinked files and I'm not sure those remember what their paths were.

Check out rwsnoop, included in macOS. It use Dtrace to trace the read/write syscalls. You need to turn off SIP for Dtrace though afaik.

iotop ?