Run Dtrace with gource.

DtraceWithGource.sh

Here is a quick visualization of file activity using Gource :)

This was run on OSx, linux users can use strace to watch for open files, much better performance.

# Using lsof in a loop (no sudo required)
(while :; do lsof |gsed -r "s#(\w+)\s+.*\s+(.+)#$(gdate +"%s")\|\1\|M\|\2#;t;d";done) | \
	gource --realtime --filename-time 2 --highlight-users --1280x800  --log-format custom -


# Using Dtrace (better option, could replace with opensnoop possibly but still requires dtrace)
sudo dtrace -n 'syscall::open*:entry { printf("%u|%s|%s",walltimestamp,execname,copyinstr(arg0)); }' | \
	gsed -r 's#.+ ([0-9]{10}).+\|(.+)\|(.+).+#\1\|\2\|M\|\3#;t;d' |\
	gource --realtime --filename-time 2 --highlight-users --1280x800  --log-format custom -