lsof shows you what's currently open; opensnoopf shows you what's being opened and closed, live, like a system-wide trace. Much handier if you're trying to figure out "what happened right when the bad thing happened?".