A File System Change Logger for Leopard

By Amit Singh, Google Mac Team

When you use Mac OS X, you frequently access files and folders. But you might not realize how often you are creating and modifying files and folders. Developers, power users, and even curious regular users have long been interested in observing and understanding file system changes. This desire might be for security reasons, analyzing software, troubleshooting, or just out of plain old curiosity. In any case, being able to see how files are changing on your machine in real time is a powerful capability.

About three years ago, Apple released Mac OS X Tiger. One major feature of Tiger was the Spotlight search technology, and one of Spotlights lowest-level building blocks is a kernel-level file system event notification mechanism called fsevents. Spotlight relies upon this mechanism to know about file system changes in real time. Soon after Tigers release, I released fslogger, a program that subscribes to the fsevents mechanism and displays file system change notifications as they arrive from the kernel. fslogger went on to be quite a popular tool in some circles.

In Mac OS X Leopard, the fsevents mechanism is used for more than just Spotlight. Apple even added the FSEvents API as a way for your applications to ask for notification when contents of a directory hierarchy are modified. (Being directory-level, FSEvents API notifications arent as granular as directly using fsevents, like fslogger does, but then direct use of fsevents isnt without caveats either.) All said, it can indeed be greatly useful during experimentation to be able to retrieve complete, unfiltered fsevents data from the kernel.

Heres an excerpt from fsloggers output.

$ sudo ./fslogger
...
=> received 90 bytes
# Event
  type           = FSE_STAT_CHANGED
  pid            = 13 (syslogd)
  # Details
    # type           len  data
    FSE_ARG_STRING    24  string = /private/var/log/asl.db
    FSE_ARG_DEV        4  dev    = 0xe000002 (major 14, minor 2)
    FSE_ARG_INO        4  ino    = 4277280
    FSE_ARG_MODE       4  mode   = -rw-------  (0x008180, vnode type VREG)
    FSE_ARG_UID        4  uid    = 0 (root)
    FSE_ARG_GID        4  gid    = 0 (wheel)
    FSE_ARG_INT64      8  tstamp = 25511051709692
    FSE_ARG_DONE (0xb33f)
...

I had to make some changes to fslogger to make it compatible with Leopard. Heres the new version that works with Leopard. Source code is also available.

Related Posts by Categories