README.md

   1 # fseventw
   2
   3 This small utility watches for all filesystem write activity using the official CoreServices
   4 FSEvents API. This will report write events on the root filesystem.
   5
   6 Because this uses the CoreServices API rather than the kernel event device, it does not blame the
   7 write to a specific PID.
   8
   9 The output is a continuous stream of messages in the following format:
  10
  11 `event 26fb14f CMRNMOX at /private/var/folders/93/t6gtn1pn4vx9j4wjnzvkzz8m003bw/T/.com.google.Chrome.6oIYcA`
  12
  13 The first HEX number is the event ID. The second string describes the type of change that occurred.
  14 Each position refers to a specific type of modification. In order:
  15
  16 * C - Create
  17 * M - Modify
  18 * R - Remove
  19 * N - Rename
  20 * M - Metadata modify
  21 * O - Owner modify
  22 * X - Xattr modify
  23
  24 And the last string is the path on which the event occured.