I tried Sample app given in WWDC. Using "ES_EVENT_TYPE_AUTH_OPEN" I could stop writing to file using echo. But if I use vim or text edit and edit the file it saves the changes.
I tried "ES_EVENT_TYPE_AUTHSIGNAL", "ES_EVENT_TYPE_AUTH_UNLINK", "ES_EVENT_TYPE_AUTH_TRUNCATE", but no luck.