---
name: "fspy"
section: "1"
platform: "linux"
package: "fspy"
version: "0.1.1-4"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/fspy"
---

# fspy(1)

filesystem activity monitoring tool

## NAME

fspy - filesystem activity monitoring tool

## SYNOPSIS

**fspy** \[*options*\] \[*file/dir*\]

## OPTIONS

- **-F**, **--filter** STRING/REGEX

  a string or regular expression which will be used to filter the output. (the regex will be matched against the whole path e.g. \[/etc/passwd\])

- **-I**, **--inverted** STRING/REGEX

  its the same like **-F**/--filter but inverted. you can combine both. e.g. **-F** '.conf' **-I** 'wvdial.conf' will filter for files with ".conf" in its name but without "wvdial.conf" in it.

- **-R**, **--recursive** NUMBER

  enables the recursive engine to look at a depth of NUMBER.

- **-A**, **--adaptive**

  (HIGHLY-EXPERIMENTAL) enables the adaptive mode. e.g. if new items will be added within the path fspy will automatically add those items to the watch list.

- **-D**, **--diff** VALUE

  (EXPERIMENTAL) enables the diffing feature. VALUE may be a comma separated list of: s - element size (byte) A - last access time (e.g. Mon Jul 21 21:32:31 2008) M - last modification time (e.g. Mon Jul 21 21:32:31 2008) S - last status change time (e.g. Mon Jul 21 21:32:31 2008) O - permissions (octal) U - owner (uid) G - group (gid) I - inode number D - device id

- **-T**, **--type** VALUE

  specifies the type of objects to look for. VALUE may be a comma separated list of: f - regular file d - directory s - symlink p - FIFO/pipe c - character device b - block device o - socket default is any.

- **-O**, **--output** VALUE

  specifies output format. VALUE may be a comma separated list of: f - filename p - path d - access description t - element type s - element size (byte) w - watch descriptor (inotify manpage) c - cookie (inotify manpage) m - access mask (inotify manpage \| src/fsevents.h) l - len (inotify manpage) A - last access time (e.g. Mon Jul 21 21:32:31 2008) M - last modification time (e.g. Mon Jul 21 21:32:31 2008) S - last status change time (e.g. Mon Jul 21 21:32:31 2008) O - permissions (octal) U - owner (uid) G - group (gid) I - inode number D - device id T - date and time (for this event) (e.g. Tue Mar 25 09:23:16 CET 2008) e.g.: '\[,T,\], ,d,:,p,f' would result in: '\[Mon Sep  1 12:31:25 2008\] file was opened:/etc/passwd' (take a look at the README).

- **-h**, **--help**

  this short help.

- **--version**

  version information.

## AUTHOR

fspy is Copyright 2008-2009, Richard Sammet

This manual page was written by Giuseppe Iuculano \<giuseppe@iuculano.it\>, for the Debian project (but may be used by others).