dlcowen/FSEventsParser

[Question]: Location of .fseventd that contains the fsevents db on Big Sur

Opened this issue · 2 comments

hu13 commented

Hi there, apologize if this question is out of scope here.

  1. But I am having trouble searching for .fseventd on macOS Big Sur.
    The suggested location at /Volumes/Macintosh HD does NOT seem to contain that directory.

  2. For node_id (inode number of each file) introduced in high sierra, I am wondering if you know whether the official apple core sdk provides a way to get this? Their callback that returns the events does not seem to have that option
    https://developer.apple.com/documentation/coreservices/fseventstreamcallback?language=objc#declaration
    Yet, your README indicates that the node_id exists on the fsevents log db.

Thanks.

  1. On Big Sur (11.6.2), I found the .fseventsd directory at /System/Volume/Data
  2. Yes you can receive the inode for each event. You have to specify the kFSEventStreamCreateFlagUseExtendedData flag when calling FSEventStreamCreate. Then in your callback you get a dictionary containing inode and path for each event instead of just the path.
hu13 commented

@sirnacnud appreciate it.