How to observe one particular directory?

I created an ES Client, as I run it, it logs all the processes under /. So I add mute_path_prefix for those.

I expect to see Notifications from /Users/anoopvaidya/, but it is not happening.

What am I missing here? Any help, suggestions, guidance is highly appreciated.

static void handleEvent(es_client_t *client, const es_message_t *msg)
{
    char const *filePath = msg->process->executable->path.data;
    NSString *filePathString = [[NSString alloc] initWithFormat:@"%s", filePath];

    os_log(OS_LOG_DEFAULT, "filePathString = %@", filePathString);
    
}

void mutePath(es_client_t *client) {
    os_log(OS_LOG_DEFAULT,"Adding muted files list");
    
    NSArray<NSString *> *paths = @[
        @"/Applications/",
        @"/bin/",
        @"/cores/",
        @"/Library/",
        @"/opt/",
        @"/private/",
        @"/sbin/",
        @"/System/",
        @"/usr/",
        @"/var/",
    ];
    
    for (NSString *path in paths) {
        es_mute_path_prefix(client, [path UTF8String]);
    }
}

int main(int argc, char *argv[])
{
    // Create the client
    es_client_t *client = NULL;
    es_new_client_result_t newClientResult = es_new_client(&client, ^(es_client_t *c, const es_message_t *message) {
        handleEvent(client, message);
    });

    if (newClientResult != ES_NEW_CLIENT_RESULT_SUCCESS) {
        return 1;
    }
    
    es_event_type_t events[] = {
        ES_EVENT_TYPE_NOTIFY_CREATE, //create file
        ES_EVENT_TYPE_NOTIFY_OPEN, // open file
        ES_EVENT_TYPE_NOTIFY_RENAME, // rename file
        ES_EVENT_TYPE_NOTIFY_CLOSE, // close file
        ES_EVENT_TYPE_NOTIFY_WRITE, // write to file
        ES_EVENT_TYPE_NOTIFY_UNLINK, // delete
        ES_EVENT_TYPE_NOTIFY_EXIT
    };
    
    if (es_subscribe(client, events, sizeof(events) / sizeof(events[0])) != ES_RETURN_SUCCESS) {
        os_log(OS_LOG_DEFAULT, "Failed to subscribe to events");
        es_delete_client(client);
        return 1;
    }
    
    mutePath(client);

    dispatch_main();
}

Accepted Reply

If you remove the path mutes, do you get any notifications?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

  • Yes, I get notifications for entire disk for all the applications.

    But how to observe one particular folder/directory in my home folder? I want to check if any file got access (CRUD operations), instead of some applications' notifications. Is this even possible to achieve what FSEvents do?

Add a Comment

Replies

If you remove the path mutes, do you get any notifications?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

  • Yes, I get notifications for entire disk for all the applications.

    But how to observe one particular folder/directory in my home folder? I want to check if any file got access (CRUD operations), instead of some applications' notifications. Is this even possible to achieve what FSEvents do?

Add a Comment