Track file changes with fseventer and DaemonFS

There are many times when in troubleshooting your Mac, it is useful to see what files on the system are being modified. For instance, if you are having difficulty with some system preferences and know what preference files are being used to store the system settings, you can further troubleshoot the problem by manually editing the files or removing them. The problem with doing this is that sometimes you can't easily find the files that are being modified.

Though you can use the Finder to search for and sort files by modification date, this is only useful for visible files that are in Spotlight's index or for which you specifically know their locations.

Instead of using the Finder to locate these files, another method is to make use of the system's fsevents daemon, which is a lower-level file system monitoring process that constantly polls the drive for file system changes. This process is used by Time Machine to copy changed files without having to searching through the whole drive and compare it with the current backup.

Though fseventsd is primarily used by system processes, it can be used by third-party utilities, either alone or in conjunction with their own implementations of fsevents, to show you an active monitor of changes to the file system. This will allow you to see what files are being used by current applications, as well as perform changes to settings and see what files on disk are affected by those changes, all in real-time.

Currently there are two such utilities I know about with this capability. The first is fseventer which is donationware (freeware with a request for a donation for development support), and the second is DaemonFS, which is freeware.

DaemonFS
This 15MB utility (relatively large for what it does) is a simple drag-and-drop install. When run, it asks you to select specific files or directory trees to monitor, and after indexing the designated files, it will start live monitoring and show you the changes made to those files. The program is a list interface that shows the file, the action performed on it, and the time that action was performed.

The main benefit of DaemonFS is the ability to specify which files to monitor, so instead of getting a full list of files you are not interested in, you can pinpoint the ones to get updated information on.

DaemonFS can be downloaded from the DaemonFS Web site.

fseventer
Of the two fsevents-monitoring utilities, I like this one the best. It is a lightweight (1.5MB) application that utilizes both a list view as well as a relatively intuitive graphical mapping of modified files. The graphical approach allows you to easily see which modified files are along a similar path, or along a completely different branch of the file system. As you use your computer, you can see the displayed tree grow and shrink, showing temporary file usage as well as cache updates and saves to actual files.

The program has the ability to limit the number of monitored files, or show up to 10,000 files on the screen at once. You can also change the tree views and set an expiration time for monitored files that have not been recently updated.

The final feature of fseventer that I like is when it's in list view, it will show you the process that was responsible for each event, so you can see when Mail has created or modified files and folders, or when other applications or system processes are performing their tasks.

The one drawback to the program is that it goes absolutely haywire when you run a Time Machine backup, antivirus scan, or another application that heavily accesses the hard drive.

fseventer can be downloaded from the Fseventer Web site.

Questions? Comments? Have a fix? Post them below or e-mail us!
Be sure to check us out on Twitter and the CNET Mac forums.