# nowsecure/fsmon

Filesystem monitor tool for Linux/Android iOS/macOS

Repository: https://github.com/nowsecure/fsmon
Canonical: https://ross.abutalabs.com/products/fsmon
Homepage: https://www.nowsecure.com
Language: C
License: MIT
License Family: permissive
Topics: tracing, osx, linux, android, filesystem, nowsecure, dynamic-analysis
Last push: 2026-04-11T13:42:05+00:00

## Health v2 (maintenance only)
Score: 57/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 76, release rhythm 8, longevity 100
- inputs: {"age_days": 3885, "days_push": 144, "days_rel": 484, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1023, forks 161 (observed 2026-08-28T04:03:16.242447+00:00)

## What it is
fsmon is a low-level, cross-platform filesystem monitoring CLI tool written in C that reports real-time file operations (create, delete, modify, rename) on Linux, Android, iOS, and macOS. It supports multiple OS backends (inotify, fanotify, FSEvents, kdebug, kqueue), process/PID filtering, recursive directory watching, and JSON or colored terminal output.

## Use cases
- monitor filesystem changes in real time on linux or macos
- trace which process is modifying files in a directory
- watch file system activity on android or ios device
- output file events as json for log pipelines
- debug io-heavy application file access
- forensic analysis of file operations during incident response
- observe filesystem access behavior of a suspicious binary

## When to choose
- you need a lightweight native CLI to watch file events across linux, macos, android, or ios
- you want process-level attribution (pid, name, uid) for file operations
- you need structured JSON output to feed into other tooling
- you are doing dynamic analysis, forensics, or reverse engineering of file access

## When to avoid
- you need a cross-platform GUI file watcher or desktop notification app
- you need network or syscall-wide tracing beyond the filesystem
- you need a long-running monitoring service with alerting and dashboards
- you need Windows support, which is not available

## Facets
- artifact type: cli-tool
- maturity: active
- function: monitoring, tracing, file-system, security, developer-tools, cli
- domain: security, developer-tools, files, reverse-engineering
- platform: cli, cross-platform
- tags: inotify, fanotify, fsevents, forensics, dynamic-analysis, incident-response, json-output, c, command-line, linux, macos, android, ios

## Member repositories
- nowsecure/fsmon (main) score 57

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:16.242447+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:08:39.065088+00:00, confidence not recorded.
  - readme: https://github.com/nowsecure/fsmon (fetched 2026-08-28T04:03:16.242447+00:00, sha b68304a81910)
  - homepage: https://www.nowsecure.com (fetched 2026-08-29T13:09:02.556421+00:00, sha 185e4daeb2ba)
  - site_page: https://www.nowsecure.com/products/technology-integrations (fetched 2026-08-29T13:09:02.566081+00:00, sha 55329da72e08)
  - site_page: https://www.nowsecure.com/nowsecure-difference (fetched 2026-08-29T13:09:02.568073+00:00, sha 704b2acdd9b3)
  - site_page: https://www.nowsecure.com/press-releases/nowsecure-introduces-ai-native-testing-to-match-the-speed-of-ai-driven-app-development (fetched 2026-08-29T13:09:02.569901+00:00, sha 6cde4290ef92)
  - site_page: https://www.nowsecure.com/company (fetched 2026-08-29T13:09:02.571587+00:00, sha ab63fdb6b460)
  - site_page: https://www.nowsecure.com/products/ai-navigator (fetched 2026-08-29T13:09:02.573127+00:00, sha 4904fb1530ab)
  - site_page: https://www.nowsecure.com/solutions/by-need/mobile-app-security-testing (fetched 2026-08-29T13:09:02.575205+00:00, sha 2e2058682e0a)
- Data as of 2026-08-30T08:39:29.467469+00:00.