Scroll to navigation

FSPY(1) User Commands FSPY(1)

NAME

fspy - manual page for fspy filesystem activity monitor

SYNOPSIS

fspy [options] [file/dir]

OPTIONS

a string or regular expression which will be used to filter the output. (the regex will be matched against the whole path e.g. [/etc/passwd])
its the same like -F/--filter but inverted. you can combine both. e.g. -F '.conf' -I 'wvdial.conf' will filter for files with ".conf" in its name but without "wvdial.conf" in it.
enables the recursive engine to look at a depth of NUMBER.
(HIGHLY-EXPERIMENTAL) enables the adaptive mode. e.g. if new items will be added within the path fspy will automatically add those items to the watch list.
Show which process (PID/UID/CMD) triggered each event. Useful for debugging and security monitoring. (Requires root privileges)
(EXPERIMENTAL) enables the diffing feature. VALUE may be a comma separated list of: s - element size (byte) A - last access time (e.g. Mon Jul 21 21:32:31 2008) M - last modification time (e.g. Mon Jul 21 21:32:31 2008) S - last status change time (e.g. Mon Jul 21 21:32:31 2008) O - permissions (octal) U - owner (uid) G - group (gid) I - inode number D - device id
specifies the type of objects to look for. VALUE may be a comma separated list of: f - regular file d - directory s - symlink p - FIFO/pipe c - character device b - block device o - socket default is any.
specifies output format. VALUE may be a comma separated list of: f - filename p - path d - access description t - element type s - element size (byte) w - watch descriptor (inotify manpage) c - cookie (inotify manpage) m - access mask (inotify manpage | src/fsevents.h) l - len (inotify manpage) A - last access time (e.g. Mon Jul 21 21:32:31 2008) M - last modification time (e.g. Mon Jul 21 21:32:31 2008) S - last status change time (e.g. Mon Jul 21 21:32:31 2008) O - permissions (octal) U - owner (uid) G - group (gid) I - inode number D - device id T - date and time (for this event) (e.g. Tue Mar 25 09:23:16 CET 2008) e.g.: '[,T,], ,d,:,p,f' would result in: '[Mon Sep 1 12:31:25 2008] file was opened:/etc/passwd' (take a look at the README).
this short help.
version information.

version: 0.2.1 build: 2026021610 codename: 25c3 license: GPL v2+

original author: Richard Sammet (e-axe) <richard.sammet@gmail.com>

February 2026 Linux filesystem activity monitor