1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
Description: Improve README documentation
Enhance the README with better structure, clearer examples,
and more comprehensive usage instructions. Add detailed
explanations of monitoring options, filtering, and output formatting.
Author: Bean Huo <beanhuo@micron.com>
Forwarded: no
Last-Update: 2025-11-16
--- a/README
+++ b/README
@@ -1,15 +1,22 @@
FSpy
(c) Richard Sammet (e-axe)
- http://mytty.org/fspy/
+ http://mytty.org/fspy/ (defunct)
INTRODUCTION
------------
-fspy is an easy to use linux filesystem activity
-monitoring tool which is meant to be small,
-fast and to handle system resources conservative.
-you can apply filters, use diffing and your own output
-format in order to get the best results.
+fspy is a lightweight Linux filesystem activity monitoring tool built on
+the inotify kernel subsystem. It monitors filesystem events (file/directory
+access, modification, creation, deletion) in real-time.
+
+Key features:
+ - Real-time filesystem event monitoring
+ - Recursive directory watching with configurable depth
+ - Flexible filtering using strings or regular expressions
+ - Customizable output format
+ - Resource-efficient and fast
+ - Diff tracking for file attributes (size, timestamps, permissions, etc.)
+ - Type-specific monitoring (files, directories, symlinks, etc.)
REQUIREMENTS (to be clarified)
@@ -28,19 +35,49 @@ binary to /usr/local/bin.
EXAMPLES
--------
-fspy -R 2 -T f,d /etc/
+Basic monitoring:
+ fspy /tmp/
+ Monitor all filesystem events in /tmp/ (non-recursive)
-this command will use /etc/ as its base dir with
-a recursive depth of 2, which means that all files and dirs
-(because of -T f,d) within /etc/*/*/* will be monitored.
+Recursive monitoring:
+ fspy -R 2 -T f,d /etc/
+ Monitor files and directories in /etc/ with recursive depth of 2
+ (monitors /etc/*/*/* - base dir plus 2 levels deep)
-fspy -D s,A -O '[,T,], ,d,:,p,f, size: ,s, atime: ,A' /tmp/
+Filtering output:
+ fspy -F '\.conf$' /etc/
+ Monitor only files ending with .conf in /etc/
-will monitor /tmp/ for filesystem activities, print out
-the requested information (-O) and highlight changes of the
-size (s) and atime (A) of elements within /tmp/.
+ fspy -F '\.conf' -I 'wvdial.conf' /etc/
+ Monitor .conf files but exclude wvdial.conf
-try it, you will see it is as easy as 1,2,3 ;)
+Custom output format:
+ fspy -O '[,T,], ,d,:,p,f' /tmp/
+ Output: [Mon Sep 1 12:31:25 2008] file was opened:/tmp/myfile
+
+ fspy -O 'Event: ,d, | Path: ,p,f, | Type: ,t' /var/log/
+ Output: Event: file was modified | Path: /var/log/syslog | Type: file
+
+Diff tracking (highlight changes):
+ fspy -D s,A -O '[,T,], ,d,:,p,f, size: ,s, atime: ,A' /tmp/
+ Track and display size and access time changes
+
+ fspy -D s,M,O /home/user/documents/
+ Monitor size, modification time, and permissions changes
+
+Type-specific monitoring:
+ fspy -T f -R 3 /var/log/
+ Monitor only regular files, 3 levels deep
+
+ fspy -T d /tmp/
+ Monitor only directories
+
+Adaptive mode (experimental):
+ fspy -A -R 2 /var/
+ Automatically add newly created items to the watch list
+
+For more details on options, run: fspy --help
+Or see the manpage: man fspy
MISC
|
