system-wide file creation notification

There are three supported strategies for this:

• Kauth, Technote 2127 Kernel Authorization

• FSEvents

There are other techniques for monitoring specific files (kqueue, file coordination, and so on) but these are the two that let you monitor an entire hierarchy.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Thanks Quinn,

Kauth is working for me but when I try to use FSEvents and register it using:

FSEventStreamCreateRelativeToDevice(...) for path "/"

then, I don't see any events reported for externally mounted drive e.g. a USB Mac-formatted volume. I do get that with KAuth but not with FSEvents. I wanted to confirm if that's indeed how it's supposed to be.

The obvious gotcha here is permissions: FSEvents will only send you events for things that you have permission to see.

Beyond that, it’s hard to say. Can you get FSEvents working at all (for example, using

FSEventStreamCreate

btw There’s sample code for

FSEventStreamCreate

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"