[comex]

It still works if you turn off SIP. This is the same on Apple Silicon and Intel. However, for these purpose of tracking file accesses, I recommend using `eslogger` instead, as it doesn’t require disabling SIP and is faster, among other advantages.

[k4ch0w]

Use fs_usage. https://ss64.com/osx/fs_usage.html

It’ll show all file events. No need to disable SIP. SIP is doing a lot of good work for users and unless you’re doing kernel work or low level coding I’d keep it enabled. Obv. There are other cases but for the general public keep it on.

[zarzavat]

It’s personal preference. If the security people had their way we’d all be developing on iPads. If SIP interferes with your work: turn it off. Linux doesn’t have SIP and it’s just fine to develop on Linux as well.

[k4ch0w]

100% agree. We would put everyone on chromebooks if we had our way. I don’t think it’s good for productivity and generating new ideas for a company so I never advocate for it.

[viraptor]

On M2 it is completely broken. Any usage of dtrace will hang the whole desktop. (Not sure if just the desktop or is it the whole kernel crashing)

Feel free to reference my feedback entry FB12061147 if you're reporting the same.

[djxfade]

You can also use Activity Monitor and view process details to see all open file handles etc

[lost_tourist]

Sure but I don't think that most programs keep their config files open the whole time they're running.