You execute this script in a Terminal window, specifying the file or files you want it to watch in the usual way (a space-separated list of filenames). For example, if you want it to watch the file ~/Library -> Preferences -> com.apple.finder.plist, you would run the command:
% watchfile ~/Library/Preferences/com.apple.finder.plistOr if you wanted to watch all of the com.apple preference files, you would run the command:
% watchfile ~/Library/Preferences/com.apple.*The script will print a message "info stored" when it starts watching each file and then it will check on the file each 10 seconds after that and print a message if anything about the file has changed. The messages are somewhat cryptic, indicating which things have changed since the last check. Read the rest of the hint for a breakdown on the messages you might see...
[robg adds: I tried this script, and it's really pretty interesting. It's amazing to see how much stuff is changed, and how often it's changed.]
Here's a list of the things that might be reported:
- ino - The inode number (numerical id) of the file has changed. This means that the file has been removed and recreated (with the same name).
- mode - The file permissions have changed.
- nlink - The number of hard links to this file have changed.
- uid - The owner of the file has changed.
- gid - The group ownership of the file has changed.
- size - The size (in bytes) of the file has changed.
- md5 - The MD5 digest of the file's contents has changed. (See option "-md5" below)
- atime - The time of last access of the file has changed. (See option "-atime" below)
- mtime - The time of last data modification has changed. This usually means that the contents of the file have been modified.
- ctime - The time of last status change has changed. This usually means that the ownership or permissions have changed.
Options:
- -interval By default, the script checks on the file(s) every 10 seconds. If you want to specify a different time interval, use the -interval option. E.g.: watchfile -interval 60 ~/Library/Preferences/com.apple.*. The longer the time interval, the less CPU will be used. But normally, CPU usage of this script is not a problem. On my iBook 600, watching all the com.apple preference files with the default 10 second interval takes much less than 1% of the CPU.
- -atime By default, the script does not report on access-time changes because changes to the files are more significant. And some files are accessed quite frequently so being notified each time would add to the noise. If you want to be notified of access-time changes, use the -atime option. E.g.: watchfile -atime ~/Library/Preferences/com.apple.*
- -md5 If you want the script to calculate and compare an MD5 digest for each file, use the -md5 option. This is an advanced option and not usually desirable unless you are monitoring a file for security purposes. The use of this option requires the Perl module Digest::MD5 which is not installed by default on OS X. Note that access-time changes will not be reported if the -md5 option is used since the file is accessed in order to compute the MD5 digest. E.g.: watchfile -md5 ~/Library/Preferences/com.apple.*
One final note: Although I haven't yet tried it, I think the script should need only small changes to get it to work on other operating systems (anywhere that Perl is installed). It should work as is on any Linux system. After changing the line that does the ls -l, it should even work on Windows if you install Perl.

