How to monitor file changes on network mapped drives?

Question

From what I see, network mapped drives appear as subfolders of the /Volumes folder.

What is the proper way to get file changes updates (delete/create/update) from this folder?

Would /dev/fsevents work for that?

How does Finder know about the changes?

Answer 1

You're correct, OS X mounts the network drives in /Volumes

The way to get file change updates is to use File System Events API. It is a C-based API where you would watch for all changes in specific directories (or even /).

You would create the stream with FSEventStreamCreate and starting it with FSEventStreamScheduleWithRunLoop

Be prepared to dig into the header-file as there is more documentation on it as in the Reference documentation

From what I can tell, Finder probably uses some internal API or the kernel queues which are more complex to setup than the higher-level API of FSEvents.h

There is a nice GUI to helping you see how the whole events come in. It's called fseventer by fernlightning (not yet Yosemite ready)

Answer 2

You can use fswatch, which I find easest to install via homebrew. And, yes it does use FSEvents. Then you just do:

fswatch /Volumes/MUSIC

where MUSIC is a Samba-based music server on my network.

Here is how it looks in action... first I show the mounted volumes (and that MUSIC is Samba based) in the top window, then I start fswatch in the bottom left window, then I make modifications in the filesystem in the top window and you can see them happen in the Finder and also see in the bottom left window that fswatch tracks all the events.

You can also use it to interact with another program whenever events are detected, like this (extracted from the fswatch manpage):

Probably the simplest way to pipe fswatch to another program in order to respond to an event is using xargs:

   $ fswatch -0 [opts] [paths] | xargs -0 -n 1 -I {} [command]

• fswatch -0 will split records using the NUL character.

• xargs -0 will split records using the NUL character. This is required to correctly match impedance with fswatch.

• xargs -n 1 will invoke command every record. If you want to do it every x records, then use xargs -n x.

• xargs -I {} will substitute occurrences of {} in command with the parsed argument. If the command you are running does not need the event path name, just delete this option. If you prefer using another replacement string, substitute {} with yours.