could I know which file is altered using fsevent?

Question

I get the directory path from fsevent, such as "/User/Data/" But what I really want is "/User/Data/change.txt" I have read the programming guide, it said

typedef void ( *FSEventStreamCallback )(
    ConstFSEventStreamRef streamRef,
    void *clientCallBackInfo,
    size_t numEvents,
    void *eventPaths,
    const FSEventStreamEventFlags eventFlags[],
    const FSEventStreamEventId eventIds[]);  

eventPaths An array of paths to the directories in which event(s) occurred.

is there any method to find out which file is altered? thanks!!!! I have stuck to it for so long..

Answer 1

Depending on your usage needs, you might consider low level fsevents. The process must run as root. Here is a simple example of reading from /dev/fsevents instead of using the FSEvents wrappers. With this you will get the full path as well as the process making the change and other details.

Answer 2

An alternative is kqueue. See Appendix A of the "File System Events Programming Guide".