If you'd rather spend some of your time than your money on this, you can use the built-in fs_usage terminal command and filter its output (e.g. with grep). Works even with SIP enabled, but will then obviously only return information that SIP doesn't cover.
More info:
man fs_usage
Example showing pathname-only events but otherwise unfiltered:
More info:
Example showing pathname-only events but otherwise unfiltered: