FSLogger 2.1

File system change logger
FSLogger is a user-space app that subscribes to the same file system event notification mechanism as the Spotlight metadata server. Once active, the FSLogger application will just wait for change notifications to arrive from the file system layer in the kernel.

The various file system operations that are communicated to FSLogger (and other subscribers such as Spotlight, specifically the metadata server) include:
· File creation
· Folder creation
· File or folder deletion
· Changes to the stat structure (for example, a permission change)
· Renaming of a file or a folder
· Content modification
· Content exchange between two files
· Finder information changes
· Change of ownership

fslogger receives and displays the aforementioned events practically instantly, courtesy of the kernel's support. An event notification contains details of the file system object(s) on which the event happened.

fslogger processes this information, enhancing it marginally (for example, by determining human-friendly names corresponding to process, user, and group identifiers).

NOTE: In its current version, fslogger uses a relatively small queue for holding change notifications. Under heavy file system activity, the queue may become full, and the kernel may have to drop an event, an action which itself is an event, and is reported as such by fslogger.