3 Replies
      Latest reply: Sep 1, 2016 2:29 AM by eskimo RSS
      ambreen2006 Level 1 Level 1 (0 points)

        How can I register for system-wide file creation notification, e.g. the way anti-virus scanner automatically every new file that gets created or downloaded.

        • Re: system-wide file creation notification
          eskimo Apple Staff Apple Staff (6,260 points)

          There are three supported strategies for this:

          There are other techniques for monitoring specific files (kqueue, file coordination, and so on) but these are the two that let you monitor an entire hierarchy.

          Share and Enjoy

          Quinn “The Eskimo!”
          Apple Developer Relations, Developer Technical Support, Core OS/Hardware
          let myEmail = "eskimo" + "1" + "@apple.com"

            • Re: system-wide file creation notification
              ambreen2006 Level 1 Level 1 (0 points)

              Thanks Quinn,

               

              Kauth is working for me but when I try to use FSEvents and register it using:

               

              FSEventStreamCreateRelativeToDevice(...) for path "/"

               

              then, I don't see any events reported for externally mounted drive e.g. a USB Mac-formatted volume. I do get that with KAuth but not with FSEvents. I wanted to confirm if that's indeed how it's supposed to be.

                • Re: system-wide file creation notification
                  eskimo Apple Staff Apple Staff (6,260 points)

                  The obvious gotcha here is permissions: FSEvents will only send you events for things that you have permission to see.

                  Beyond that, it’s hard to say.  Can you get FSEvents working at all (for example, using FSEventStreamCreate)?  I recommend you start there and then move on to the per-edviec stuff.

                  btw There’s sample code for FSEventStreamCreate on the developer web site.

                  Share and Enjoy

                  Quinn “The Eskimo!”
                  Apple Developer Relations, Developer Technical Support, Core OS/Hardware
                  let myEmail = "eskimo" + "1" + "@apple.com"