How can I register for system-wide file creation notification, e.g. the way anti-virus scanner automatically every new file that gets created or downloaded.
Replies
There are three supported strategies for this:
Kauth, Technote 2127 Kernel Authorization
There are other techniques for monitoring specific files (kqueue, file coordination, and so on) but these are the two that let you monitor an entire hierarchy.
Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"
Thanks Quinn,
Kauth is working for me but when I try to use FSEvents and register it using:
FSEventStreamCreateRelativeToDevice(...) for path "/"
then, I don't see any events reported for externally mounted drive e.g. a USB Mac-formatted volume. I do get that with KAuth but not with FSEvents. I wanted to confirm if that's indeed how it's supposed to be.
The obvious gotcha here is permissions: FSEvents will only send you events for things that you have permission to see.
Beyond that, it’s hard to say. Can you get FSEvents working at all (for example, using
FSEventStreamCreate
)? I recommend you start there and then move on to the per-edviec stuff.
btw There’s sample code for
FSEventStreamCreate
on the developer web site.
Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"