nowsecure/fsmon

Health v2 · maintenance only

Adoption not part of the score

1023 stars · 161 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

fsmon is a low-level, cross-platform filesystem monitoring CLI tool written in C that reports real-time file operations (create, delete, modify, rename) on Linux, Android, iOS, and macOS. It supports multiple OS backends (inotify, fanotify, FSEvents, kdebug, kqueue), process/PID filtering, recursive directory watching, and JSON or colored terminal output.

Use cases

• monitor filesystem changes in real time on linux or macos
• trace which process is modifying files in a directory
• watch file system activity on android or ios device
• output file events as json for log pipelines
• debug io-heavy application file access
• forensic analysis of file operations during incident response
• observe filesystem access behavior of a suspicious binary

When to choose

• you need a lightweight native CLI to watch file events across linux, macos, android, or ios
• you want process-level attribution (pid, name, uid) for file operations
• you need structured JSON output to feed into other tooling
• you are doing dynamic analysis, forensics, or reverse engineering of file access

When to avoid

• you need a cross-platform GUI file watcher or desktop notification app
• you need network or syscall-wide tracing beyond the filesystem
• you need a long-running monitoring service with alerting and dashboards
• you need Windows support, which is not available

Facets

cli-tool · maturity active

monitoring tracing file-system security developer-tools cli security developer-tools files reverse-engineering cli cross-platform inotify fanotify fsevents forensics dynamic-analysis incident-response json-output c command-line linux macos android ios

Member repositories

For agents

markdown · JSON · MCP: product_card(name="nowsecure/fsmon")