forked from nowsecure/fsmon
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathfsmon.1
48 lines (48 loc) · 945 Bytes
/
fsmon.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
.Dd Apr 5, 2016
.Dt FSMON 1
.Sh NAME
.Nm fsmon
.Nd FileSystem events Monitor
.Sh SYNOPSIS
.Nm fsmon
.Op Fl chjfv
.Op [-a sec]
.Op [-b dir]
.Op [-p pid]
.Op [-P proc]
.Sh DESCRIPTION
This utility wait for events happening in a specific filesystem directory, it allows to filter by pid, path and even create a backup of the modified files.
.Sh OPTIONS
.Bl -tag -width Fl
.It Fl a Ar sec
stop monitoring after some seconds
.It Fl b Ar dir
backup directory to store the backup
.It Fl c
follow children of -p pid
.It Fl h
show usage help message
.It Fl j
output in JSON
.It Fl f
show filename only (no path)
.It Fl p Ar pid
grab events produced by this pid
.It Fl P Ar proc
grab events produced by this process name
.It Fl v
show version
.El
.Sh USAGE
.Pp
$ sudo fsmon -a 10 -j | json_pp
.Pp
.Sh AUTHORS
.Pp
Written by Sergi Alvarez <[email protected]>
.Pp
Developed at NowSecure '2015
.Pp
.Sh LICENSE
.Pp
This software is under the MIT license.