From 15160992c08fa2d55b04250e4e5abfc6017f7955 Mon Sep 17 00:00:00 2001 From: Robert Sesek Date: Fri, 20 Mar 2015 13:27:30 -0400 Subject: [PATCH] Add a README.md --- README.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..507d8db --- /dev/null +++ b/README.md @@ -0,0 +1,24 @@ +# fseventw + +This small utility watches for all filesystem write activity using the official CoreServices +FSEvents API. This will report write events on the root filesystem. + +Because this uses the CoreServices API rather than the kernel event device, it does not blame the +write to a specific PID. + +The output is a continuous stream of messages in the following format: + +`event 26fb14f CMRNMOX at /private/var/folders/93/t6gtn1pn4vx9j4wjnzvkzz8m003bw/T/.com.google.Chrome.6oIYcA` + +The first HEX number is the event ID. The second string describes the type of change that occurred. +Each position refers to a specific type of modification. In order: + +* C - Create +* M - Modify +* R - Remove +* N - Rename +* M - Metadata modify +* O - Owner modify +* X - Xattr modify + +And the last string is the path on which the event occured. -- 2.22.5