There's also fs_usage that doesn't require disabling SIP:

https://mohit.io/blog/fs_usage-trace-file-system-calls-on-ma...