[excerpts from his blog entry follow]
fs_usage is a command line tool that displays file system activity.
That’s a little better, but still a firehose. You can cut it down by grepping out the CACHE_HIT lines and grep’s own reads:
$ sudo fs_usage -e -f filesystem|grep -v CACHE_HIT|grep -v grep
Now you have a solid base. It’s still a lot of information delivered pretty quickly, but now it’s realistic to — say — start the recording, do your thing, stop the recording and comb through the resulting logs.
Of course, you can further focus the output. For example, discover what files are being opened, as they’re being opened:
$ sudo fs_usage -e -f filesystem|grep -v CACHE_HIT|grep -v grep|grep open
Or, who’s writing to your disk:
$ sudo fs_usage -e -f filesystem|grep -v CACHE_HIT|grep -v grep|grep write