fsmon is a low-level, cross-platform filesystem monitor that reports kernel-level file events on Linux, Android, iOS and macOS as colourful terminal output or JSON, built for system administrators, incident responders, security researchers, forensic analysts, developers debugging I/O-heavy applications, and reverse engineers.

What it is

fsmon is a portable C utility from NowSecure, authored by pancake and released under the MIT licence, that retrieves filesystem events from a given directory by hooking into the operating system's kernel tracing facilities or file notification APIs. It compiles to a native binary with no runtime dependencies beyond standard libraries, targeting x86, arm, arm64 and mips on Linux, Android, macOS and, with limited support, iOS. The project sits in the low-level systems monitoring ecosystem directly alongside the kernel interfaces it consumes: inotify and fanotify on Linux and Android, and kdebug, FSEvents, kqueue and /dev/fsevents on Apple platforms.

The concrete problem it solves is that filesystem visibility is fragmented by platform. A Linux-only watcher cannot follow the same investigation onto an Android handset or a Mac, and raw kernel notification streams rarely carry the process context an analyst needs to attribute an event. fsmon replaces the practice of assembling a separate single-platform watching tool for each host by normalising event capture behind one command-line interface and one output schema, so the same invocation works against /data on Android and /home on Linux.

Key capabilities

• Multi-backend monitoring selected automatically or forced with -B name, covering inotify and fanotify on Linux and Android, and fsevapi, kdebug, devfsev and kqueue on iOS and macOS; fsmon -L lists every available backend.
• Event type coverage including CREATE_FILE, DELETE, RENAME, OPEN, CLOSE, STAT_CHANGED, CHOWN, CHMOD, XATTR_MODIFIED, CONTENT_MODIFIED, EXCHANGE and FINDER_INFO_CHANGED.
• Structured output through -j for JSON and -J for a JSON stream, designed for pipelines such as fsmon -J / | jq -r .filename and for collection into ELK.
• Process-level insight that associates file events with process names, PIDs and UIDs where the platform allows, with filtering by PID (-p), process name (-P) and child processes (-c).
• Recursive monitoring of whole directory trees, dynamically adding newly created directories as they appear.
• Timestamping of every event and optional presentation controls, including -f to show only the filename and -n to disable colours.
• Timed sessions and clean shutdown via -a sec plus handling of SIGINT, SIGTERM and SIGALRM, and experimental backup of changed files into a separate directory with -b dir.

Who uses it and how

• System administrators and incident responders run it against a live directory tree such as fsmon /data to watch creation, deletion and modification as they happen.
• Forensic analysts use event timestamps and the JSON formats to feed structured logs into downstream tooling and to preserve an ordered record of attribute and content changes.
• Reverse engineers and dynamic-analysis researchers point it at Android and iOS devices to observe filesystem access behaviour, including cross-compiled builds produced with make android NDK_ARCH= ANDROID_API= and make ios.
• Developers debugging I/O-heavy applications narrow output to a single process and its children with -p and -c to isolate which component is touching which path.

Getting started

On macOS the tool installs through Homebrew with brew tap nowsecure/fsmon https://github.com/nowsecure/fsmon followed by brew install nowsecure/fsmon/fsmon. Elsewhere, run make and then make install PREFIX=/usr, or download a prebuilt binary from the releases page.

How it compares

The available facts name no paid products and no competing tools, so fsmon stands alone in this registry rather than being positioned against an alternative. No licence, hosting or cost comparison is possible from the material provided.

When to use it — and when not to

fsmon carries no runtime dependencies beyond standard libraries and is installed either by a single make or by Homebrew, so there is almost nothing to operate beyond the binary itself — but the underlying kernel support is the real constraint, since fanotify is not always available on Android and iOS coverage is limited to FSEvent APIs. The -b backup mode is explicitly marked experimental, so it should not be relied on as a primary copy mechanism. Anyone needing guaranteed iOS coverage, a supported backup subsystem or a large maintained project with a broad contributor base should look elsewhere; this is a focused utility with a small open issue count and a scope deliberately bounded by what each platform's tracing layer exposes.

brew tap nowsecure/fsmon https://github.com/nowsecure/fsmon
brew install nowsecure/fsmon/fsmon

make
make install PREFIX=/usr

$ ./fsmon -h
Usage: ./fsmon-macos [-Jjc] [-a sec] [-b dir] [-B name] [-p pid] [-P proc] [path]
 -a [sec]  stop monitoring after N seconds (alarm)
 -b [dir]  backup files to DIR folder (EXPERIMENTAL)
 -B [name] specify an alternative backend
 -c        follow children of -p PID
 -f        show only filename (no path)
 -h        show this help
 -j        output in JSON format
 -J        output in JSON stream format
 -n        do not use colors
 -L        list all filemonitor backends
 -p [pid]  only show events from this pid
 -P [proc] events only from process name
 -v        show version
 [path]    only get events from this path
Examples:
 fsmon /data
 fsmon -J / | jq -r .filename
 fsmon -B fanotify /home
$

$ make

$ make android NDK_ARCH=<ARCH> ANDROID_API=<API>