---
name: "fs_usage"
section: "1"
platform: "macos"
package: "system_cmds"
version: "1042.120.1"
release: "macOS 26.5"
platforms: ["macos"]
url: "https://new.carta.tech/fs_usage"
---

# fs\_usage(1)

report system calls and page faults related to filesystem activity in real-time

## NAME

**fs\_usage** – report system calls and page faults related to filesystem activity in real-time

## SYNOPSIS

**fs\_usage** \[**-e**\] \[**-w**\] \[**-f** *mode*\] \[**-b**\] \[**-t** *seconds*\] \[**-R** *rawfile* \[**-S** *start\_time* **-E** *end\_time*\]\] \[**-F**\] \[*pid* \| *cmd* \[*pid* \| *cmd* \[...\]\]\]

## DESCRIPTION

The **fs\_usage** utility presents an ongoing display of system call usage information pertaining to filesystem activity. It requires root privileges due to the kernel tracing facility it uses to operate. By default, the activity monitored includes all system processes except the running **fs\_usage** process, Terminal, telnetd, telnet, sshd, rlogind, tcsh, csh, sh, and zsh. These defaults can be overridden such that output is limited to include or exclude a list of processes specified by the user.

The output presented by **fs\_usage** is formatted according to the size of your window. A narrow window will display fewer columns of data. Use a wide window for maximum data display. You may override the window formatting restrictions by forcing a wide display with the **-w** option. In this case, the data displayed will wrap when the window is not wide enough.

The options are as follows:

- **-e**

  Specifying the **-e** option generates output that excludes sampling of the running fs\_usage tool. If a list of process IDs or commands is also given, then those processes are also excluded from the sampled output.

- **-w**

  Specifying the **-w** option forces a wider, more detailed output, regardless of the window size.

- **-f**

  Specifying the **-f** option turns on output filtering based on the *mode* provided. Multiple filtering options can be specified. By default, no output filtering occurs. The supported modes are:

  *network* Network-related events are displayed.

  *filesys* Filesystem-related events are displayed.

  *pathname* Pathname-related events are displayed.

  *exec* Exec and spawn events are displayed.

  *diskio* Disk I/O events are displayed.

  *cachehit* In addition, show cache hits.

- **-b**

  Specifying the **-b** option annotates disk I/O events with BootCache info (if available).

- **-t** *seconds*

  Specifies a run timeout in seconds. **fs\_usage** will run for no longer than the timeout specified.

- **-R** *raw\_file*

  Specifies a raw trace file to process.

- **-S** *start\_time*

  If **-R** is selected, specifies the start time in microseconds to begin processing entries from the raw trace file. Entries with timestamps before the specified start time will be skipped.

- **-E** *end\_time*

  If **-R** is selected, specifies the ending time in microseconds to stop processing entries from the raw trace file. Entries with timestamps beyond the specified ending time will be skipped.

- **-F**

  Specifying the **-F** option trims pathnames from the right side, keeping the front of the pathname. By default, pathnames are trimmed from the left side.

- pid \| cmd

  The sampled data can be limited to a list of process IDs or commands. When a command name is given, all processes with that name will be sampled. Using the **-e** option has the opposite effect, excluding sampled data relating to the given list of process IDs or commands.

The data columns displayed are as follows:

- TIMESTAMP

  TOD when call occurred. Wide mode will have microsecond granularity.

- CALL

  The name of the network or filesystem related call, page-in, page-out, or physical disk access.

- FILE DESCRIPTOR

  Of the form F=x, x is a file descriptor. Depending on the type of system call, this will be either an input value or a return value.

- BYTE COUNT

  Of the form B=x, x is the number of bytes requested by the call.

- \[ERRNO\]

  On error, the errno is displayed in brackets.

- PATHNAME

  Pathname of the file accessed (up to the last 28 bytes).

- FAULT ADDRESS

  Of the form A=0xnnnnnnnn, where 0xnnnnnnnn is the address being faulted.

- DISK BLOCK NUMBER

  Of the form D=0xnnnnnnnn, where 0xnnnnnnnn is the block number of the physical disk block being read or written.

- OFFSET

  Of the form O=0xnnnnnnnn, where 0xnnnnnnnn is a file offset.

- SELECT RETURN

  Of the form S=x, x is the number of ready descriptors returned by the [select(2)](/select/2.md) system call. If S=0, the time limit expired.

- TIME INTERVAL(W)

  The elapsed time spent in the system call. A ‘W’ after the elapsed time indicates the process was scheduled out during this file activity. In this case, the elapsed time includes the wait time.

- PROCESS NAME

  The process that made the system call. Wide mode will append the thread id to the process name (i.e Mail.nnn).

## SAMPLE USAGE

fs\_usage -w -f filesys Mail **fs\_usage** will display file system related data for all instances of processes named Mail. Maximum data output will be displayed in the window.

## SEE ALSO

dyld(1), [latency(1)](/latency/1.md), [sc\_usage(1)](/sc_usage/1.md), [top(1)](/top/1.md)