FSMonitor: Easily find what's being modified on your file system.

in

What tool do you use when you try to snoop it and find which find are being modified? Do you use Jamf Composer? fs_usage? FSEventer?

Well FSMonitor might be your new best buddy. It was soft launched earlier this year. I just cannot believed I missed it. Thank you, Armin Briegel, for telling me!

tree.png

Well the website is complete enough that I don't need to add anything apart from some good use cases (Tweet/Comment if you have other ones!):

  • Find which plist gets modified from a particular setting
  • Find what files get moved/installed/removed when doing something such as installing Chrome
  • See if a process is doing stuff behind your back

Just a word of caution: Packaging is hard, try not to if you can. Sometimes, pushing the original package with a Configuration Profile might suffice. Also, events might get dropped if there's too many. That's by design from the Apple API.