Controlling of Intercheck

The command to use to see what files a process has open is "lsof"

You'll want to use Activity Monitor or the "ps" command to get the PID (process ID) of InterCheck (might as well get the PIDs for other Sophos processes as well -- in Activity Monitor, you can search for Sophos to list the rest).

Once you have the PIDs for the processes you want to monitor, use the following command:

"lsof -r -p nnn,nnn,nnn" where -r keeps it looping looking for open files, -p tells it to only list the following PIDs, and "nnn,nnn,nnn" is a list of comma-delimited PIDs you want to monitor.

You can also take off the -r and put "> openfiles.txt" at the end to write a single check for open files to a text file called "openfiiles.txt" in the current working directory.

I generally find that scanning goes by so fast that lsof doesn't show any open files.

Another tool you could use is a tool called FSEventer, which will generate a real-time graph of filesystem events as they happen, and helpfully shows which files were accessed but are no longer being accessed.  It is graphical, and has a lot of filter possibilities.

It also doesn't necessarily catch files that are opened and closed before the program gets its turn looking at the event queue, so it may not find files opened by Intercheck either.  It will list any that are open for any length of time, however -- which appears to be what you're looking for.

The command to use to see what files a process has open is "lsof"

You'll want to use Activity Monitor or the "ps" command to get the PID (process ID) of InterCheck (might as well get the PIDs for other Sophos processes as well -- in Activity Monitor, you can search for Sophos to list the rest).

Once you have the PIDs for the processes you want to monitor, use the following command:

"lsof -r -p nnn,nnn,nnn" where -r keeps it looping looking for open files, -p tells it to only list the following PIDs, and "nnn,nnn,nnn" is a list of comma-delimited PIDs you want to monitor.

You can also take off the -r and put "> openfiles.txt" at the end to write a single check for open files to a text file called "openfiiles.txt" in the current working directory.

I generally find that scanning goes by so fast that lsof doesn't show any open files.

Another tool you could use is a tool called FSEventer, which will generate a real-time graph of filesystem events as they happen, and helpfully shows which files were accessed but are no longer being accessed.  It is graphical, and has a lot of filter possibilities.

It also doesn't necessarily catch files that are opened and closed before the program gets its turn looking at the event queue, so it may not find files opened by Intercheck either.  It will list any that are open for any length of time, however -- which appears to be what you're looking for.