Add a README.md

diff --git a/README.md b/README.md
new file mode 100644 (file)
index 0000000..507d8db
--- /dev/null
+++ b/README.md
@@ -0,0 +1,24 @@
+# fseventw
+
+This small utility watches for all filesystem write activity using the official CoreServices
+FSEvents API. This will report write events on the root filesystem.
+
+Because this uses the CoreServices API rather than the kernel event device, it does not blame the
+write to a specific PID.
+
+The output is a continuous stream of messages in the following format:
+
+`event 26fb14f CMRNMOX at /private/var/folders/93/t6gtn1pn4vx9j4wjnzvkzz8m003bw/T/.com.google.Chrome.6oIYcA`
+
+The first HEX number is the event ID. The second string describes the type of change that occurred.
+Each position refers to a specific type of modification. In order:
+
+* C - Create
+* M - Modify
+* R - Remove
+* N - Rename
+* M - Metadata modify
+* O - Owner modify
+* X - Xattr modify
+
+And the last string is the path on which the event occured.