Aug 18, '06 07:30:03AM • Contributed by: grasshoppermouse
OS X 10.4 has a private API that's used by Spotlight to monitor file system events such as file creation, renaming, and permission changes. Several command line and GUI tools are now available that can suscribe to the event notification system and provide a log of the events. These are useful for, e.g., monitoring files created by installers, and so forth.
For reasons that will become clear in a moment, let me first mention a few GUI tools:
- fseventer (donationware): Provides a real-time graphical view of changes occuring in your filesystem.
- Sonar (commercial): File activity monitor (I haven't tried it).
- Yank (commercial): An uninstaller (I haven't tried it).
Copy each of these binaries to /usr/local/bin, and run each in Terminal using sudo, e.g., sudo fslogger.
- fslogger: Provides verbose, plain text output. Source code not available online.
- fetool: Source and binary included with fseventer (GUI app above). The binary is located in the app bundle in fseventer.app -> (Control-click and Show Package Contents) -> Contents -> Resources. It produces compact, plain text output that uses the following event codes:
-1: FSE_INVALID 0: FSE_CREATE_FILE 1: FSE_DELETE 2: FSE_STAT_CHANGED 3: FSE_RENAME 4: FSE_CONTENT_MODIFIED 5: FSE_EXCHANGE 6: FSE_FINDER_INFO_CHANGED 7: FSE_CREATE_DIR 8: FSE_CHOWN - Sandal: So far as I can tell, you have to dig into the Sonar bundle (GUI app above) to find the binary and source code, Sonar.app -> (Control-click and Show Package Contents) -> Contents -> Resources. It produces XML output.
$ sudo fslogger > ~/Desktop/NewAppFiles.log
Related links:
[robg adds: I haven't tested any of these apps, GUI or command line. If you are going to test them, you should read the caveat on the fslogger page -- here's a snippet of it:
If you cause heavy enough file system activity (what's "heavy" will vary greatly, depending on your system and its currently available resources), both fslogger and Spotlight may miss events, causing Spotlight to spend some extra time looking at your volume. Note that Spotlight will not reindex the entire volume — it will only look for the changes that it missed.So if you try these tools and Spotlight seems to be working a bit harder than usual, the above may be the reason...]
