FSMonitor

The application watches every modification on a macOS file system, reporting creations, deletions, content edits, renames, and attribute changes as they happen. It presents these events in four built‑in display modes—tree, list, column, and text—so users can choose the layout that best fits their workflow. Filters let the user narrow the view by file path, event category, or originating process, and an inspector reveals detailed information about each change.

Typical uses include auditing scripts or applications, diagnosing performance issues, and detecting unexpected or malicious activity. Users can save a session as an FSMonitor document for later review, or export the data as JSON or plain text for external analysis. The tool also integrates with Finder and Terminal, allowing quick navigation to the affected files.

Targeted at developers, system administrators, and security analysts working on macOS 10.11 or newer, the software offers a stable, real‑time view of filesystem activity without requiring additional hardware or external services.