What is FSMonitor?
FSMonitor is a macOS application designed to monitor all changes to the file system in real-time. It tracks file creation, deletion, content modifications, renames, and attribute changes, providing users with comprehensive visibility into system activities.
The tool offers four display modes for examining changed files and includes filtering options by path, event category, or process. Users can save changes as FSMonitor documents for later review or export them as JSON or plain text. Additional features include an inspector for detailed change analysis and options to reveal files in Finder or Terminal.
Features
- Real-time Monitoring: Tracks file system changes including creation, deletion, modifications, renames, and attribute changes
- Multiple Display Modes: Offers Tree View, List View, Column View, and Text View for examining changed files
- Filtering Options: Allows filtering by path, event category, or process to focus on specific changes
- Export Capabilities: Saves changes as FSMonitor documents or exports as JSON or plain text
- Integration Tools: Reveals changed files in Finder or Terminal for easy access
Use Cases
- Auditing scripts and applications for file system activity
- Diagnosing performance problems by tracking file changes
- Catching malicious behavior through real-time monitoring of system files
- Reviewing file system changes for debugging or security analysis
- Documenting file modifications for compliance or troubleshooting purposes
