OS X 10.4 has a private API that's used by Spotlight to monitor file system events such as file creation, renaming, and permission changes. Several command line and GUI tools are now available that can suscribe to the event notification system and provide a log of the events. These are useful for, e.g., monitoring files created by installers, and so forth.
For reasons that will become clear in a moment, let me first mention a few GUI tools:
Copy each of these binaries to /usr/local/bin, and run each in Terminal using sudo, e.g., sudo fslogger.
-1: FSE_INVALID
0: FSE_CREATE_FILE
1: FSE_DELETE
2: FSE_STAT_CHANGED
3: FSE_RENAME
4: FSE_CONTENT_MODIFIED
5: FSE_EXCHANGE
6: FSE_FINDER_INFO_CHANGED
7: FSE_CREATE_DIR
8: FSE_CHOWN$ sudo fslogger > ~/Desktop/NewAppFiles.log
Related links:
[robg adds: I haven't tested any of these apps, GUI or command line. If you are going to test them, you should read the caveat on the fslogger page -- here's a snippet of it:
If you cause heavy enough file system activity (what's "heavy" will vary greatly, depending on your system and its currently available resources), both fslogger and Spotlight may miss events, causing Spotlight to spend some extra time looking at your volume. Note that Spotlight will not reindex the entire volume — it will only look for the changes that it missed.So if you try these tools and Spotlight seems to be working a bit harder than usual, the above may be the reason...]
Mac OS X Hints
http://hints.macworld.com/article.php?story=20060817044149264