Last active
February 12, 2024 00:26
-
-
Save luckman212/4bb90c65a3470cb11fba49e694dc205f to your computer and use it in GitHub Desktop.
macOS script to log xattr changes in realtime, requires `jq`
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env bash | |
| # watches for changes to xattrs and utimes | |
| # https://github.com/syncthing/syncthing/issues/9371#issuecomment-1937696552 | |
| # https://gist.github.com/luckman212/4bb90c65a3470cb11fba49e694dc205f | |
| sudo eslogger --format json setextattr deleteextattr setattrlist utimes | jq -r ' | |
| .event as $e | | |
| .process as $p | | |
| ($e | keys[0]) as $t | | |
| ($p | .executable? | (.path? | split("/")[-1] )) as $x | | |
| [.time, $t, $x, ($e[$t].extattr // ($e[$t].attrlist?|keys?|join(","))), ([($e[$t].target.path),($e[$t].mtime//empty)]|join("->"))] | | |
| @tsv' |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Added utimes / mtime logging