File system change logger
Version: 2.1FSLogger is a user-space app that subscribes to the same file system event notification mechanism as the Spotlight metadata server. Once active, the FSLogger application will just wait for change notifications to arrive from the file system layer in the kernel.
Operating System: Mac OS X
The various file system operations that are communicated to FSLogger (and other subscribers such as Spotlight, specifically the metadata server) include:
· File creation
· Folder creation
· File or folder deletion
· Changes to the stat structure (for example, a permission change)
· Renaming of a file or a folder
· Content modification
· Content exchange between two files
· Finder information changes
· Change of ownership
fslogger receives and displays the aforementioned events practically instantly, courtesy of the kernel's support. An event notification contains details of the file system object(s) on which the event happened.
fslogger processes this information, enhancing it marginally (for example, by determining human-friendly names corresponding to process, user, and group identifiers).
NOTE: In its current version, fslogger uses a relatively small queue for holding change notifications. Under heavy file system activity, the queue may become full, and the kernel may have to drop an event, an action which itself is an event, and is reported as such by fslogger.