It is indeed possible to watch every file access made on your system, everywhere, by attaching ktrace to the init process.  It’ll generate a lot of data, though.