FSMonitor is a native Mac app that watches your filesystem in real time, showing every file and folder event — reads, writes, deletes, renames, and permission changes — as they happen across any directory you choose to monitor.
What is FSMonitor?
FSMonitor is a macOS filesystem activity monitor that surfaces low-level I/O events through a clean, native interface, giving you a live window into exactly what any process is doing on disk. Think of it as a continuous audit trail for your drive — one that runs quietly in the background and captures events the moment they occur, not in a snapshot taken later.
I keep it open in a corner of my screen whenever I'm testing a new app install, debugging a runaway daemon, or just trying to figure out why my SSD light is blinking. Nothing else on Mac gives you quite this level of unfiltered, real-time disk introspection without dropping into fs_usage in Terminal and wading through thousands of raw lines.
What does FSMonitor do best?
FSMonitor excels at catching exactly which process is touching which path and when — with far less noise than the equivalent Terminal incantation and far more detail than Activity Monitor's disk tab.
- Per-process attribution: every event is stamped with the responsible process name and PID, so you know instantly whether it's Spotlight, a rogue npm build, or an app phoning home.
- Scope control: you can narrow the watch to a single folder or expand it to an entire volume, cutting the signal-to-noise ratio dramatically.
- Event filtering: read-heavy workloads generate a blizzard of events; FSMonitor lets you suppress or isolate event types so the writes, deletes, and renames you actually care about stay visible.
- Persistent logging: the stream can be saved to disk, which is invaluable for post-mortem analysis after an install script or backup job completes.
There is no close competitor in the Mac App Store doing exactly this. Little Snitch watches the network; KnockKnock watches persistence mechanisms; FSMonitor watches the drive itself. It occupies a niche that power users and developers hit regularly but rarely have a dedicated tool for.
Who should use FSMonitor?
FSMonitor is squarely aimed at developers, sysadmins, and security-conscious power users — not everyday Mac users who have no reason to care which temp files Xcode is churning through.
Concretely, you will reach for it when: auditing what a newly downloaded app writes to your home folder; debugging a build system that is mysteriously slow; verifying that a backup or sync tool (Time Machine, Dropbox, Resilio) is actually picking up changes; or hunting down the process responsible for filling your disk. It is also genuinely useful for security research — watching an app's first-run behaviour tells you a great deal about its intentions before you grant it full permissions.
Is FSMonitor free?
FSMonitor is available as a free download with a functional core, and a paid upgrade unlocks the full feature set. The pricing is modest and a one-time purchase rather than a subscription — a model that suits a utility you install and forget about until you need it urgently.
For occasional use, the free tier is likely sufficient. If you are running it as a regular part of your workflow — logging events across multiple directories, filtering complex process trees — the paid version is worth it without hesitation.
What are the best FSMonitor alternatives?
The honest answer is that direct alternatives are thin on the ground for macOS. The closest options are:
- fs_usage (Terminal): Apple's own low-level tool is comprehensive but outputs raw, unfiltered text that requires grep pipelines to make sense of. No GUI, no persistence UI, steep learning curve.
- FileMonitor (Objective-See): Patrick Wardle's free security-research tool focuses on process-to-file associations with a security lens. Excellent but more forensic than operational.
- FunctionFlux / fseventer (legacy): older tools that served this niche but have not been actively maintained for Apple Silicon.
FSMonitor sits between these: more approachable than fs_usage, more operationally useful than pure forensic tools, and actively maintained for modern macOS including Apple Silicon.
How does FSMonitor compare to Activity Monitor?
Activity Monitor shows you aggregate disk read/write throughput per process — useful for knowing which app is hammering your SSD hardest overall. FSMonitor shows you the individual file events behind that throughput: which specific paths are being written to, what the event type is, and in what order. They are complementary rather than competing. I typically glance at Activity Monitor first to identify the offending process, then open FSMonitor to understand what it is actually doing on disk.
