FSEventsParser icon indicating copy to clipboard operation
FSEventsParser copied to clipboard

[Question]: Location of .fseventd that contains the fsevents db on Big Sur

Open hu13 opened this issue 3 years ago • 2 comments

Hi there, apologize if this question is out of scope here.

  1. But I am having trouble searching for .fseventd on macOS Big Sur. The suggested location at /Volumes/Macintosh HD does NOT seem to contain that directory.

  2. For node_id (inode number of each file) introduced in high sierra, I am wondering if you know whether the official apple core sdk provides a way to get this? Their callback that returns the events does not seem to have that option https://developer.apple.com/documentation/coreservices/fseventstreamcallback?language=objc#declaration Yet, your README indicates that the node_id exists on the fsevents log db.

Thanks.

hu13 avatar Jun 03 '21 16:06 hu13

  1. On Big Sur (11.6.2), I found the .fseventsd directory at /System/Volume/Data
  2. Yes you can receive the inode for each event. You have to specify the kFSEventStreamCreateFlagUseExtendedData flag when calling FSEventStreamCreate. Then in your callback you get a dictionary containing inode and path for each event instead of just the path.

sirnacnud avatar Feb 09 '22 09:02 sirnacnud

@sirnacnud appreciate it.

hu13 avatar Feb 09 '22 16:02 hu13