macOS / binaries /

rwsnoop

/usr/bin/rwsnoop
Snoop read/write events

This is measuring reads and writes at the application level. This matches the syscalls read, write, pread and pwrite.

source: man