kqueue/kevent - watching an entire filesystem?

[Jan Bramkamp]

On 25.12.17 18:41, Conrad Meyer wrote:
> If you want to watch whole system activity (and not just a single
> filesystem), that sounds like audit.  Or its crappy cousin,
> filemon(4).  Of course, neither of these options has a kevent-style
> interface, and filemon(4) in particular may miss relevant events.
> 
> I'm afraid there is nothing better than recursively opening
> subdirectories to monitor a tree (even a whole filesystem) with
> kqueue/kevent.

Filemon would be useful in a lot of cases, but it uses newlines as 
record separators without quoting them in the detected paths. See 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224015 for more 
details. Few source files contain new files so it won't break building 
sane software in bmake meta mode, but it makes filemon unusable as a 
poor mans inotify replacement for (untrusted) user data.