FSPY(1)

✨ FSPY(1) — NAME ✨

okay bestie, so fspy is literally a filesystem activity monitor 💅 and yeah, this is the manual page for it. it lives in section 1 of the manual (User Commands energy), and it's here to watch your files do stuff. no cap. 🦋

---

🌸 SYNOPSIS 🌸

fspy [options] [file/dir]

that's it, that's the whole vibe. you give it some options, you optionally point it at a file or a dir, and it goes to work 🫶

---

🎀 OPTIONS 🎀

• -F, --filter STRING/REGEX — a string or a regular expression, and it gets used to filter the output. heads up: the regex gets matched against the whole path, like for example [/etc/passwd]. 💖
• -I, --inverted STRING/REGEX — it's the same thing as -F/--filter except inverted, obviously. and you can combine both of them!! like, for example -F '.conf' -I 'wvdial.conf' will filter for files with ".conf" in their name but without "wvdial.conf" in it. iconic filtering behaviour honestly ✨
• -R, --recursive NUMBER — turns on the recursive engine so it looks at a depth of NUMBER. go deep bestie 🌊
• -A, --adaptive — (HIGHLY-EXPERIMENTAL) enables adaptive mode. for example, if new items get added within the path, fspy will automatically add those items to the watch list. it's giving self-updating queen 👑
• -P, --show-process — shows you which process (PID/UID/CMD) triggered each event. super useful for debugging and security monitoring. (requires root privileges though, so like… bring your sudo 💀)
• -D, --diff VALUE — (EXPERIMENTAL) enables the diffing feature. VALUE may be a comma separated list of:
  • s — element size (byte)
  • A — last access time (e.g. Mon Jul 21 21:32:31 2008)
  • M — last modification time (e.g. Mon Jul 21 21:32:31 2008)
  • S — last status change time (e.g. Mon Jul 21 21:32:31 2008)
  • O — permissions (octal)
  • U — owner (uid)
  • G — group (gid)
  • I — inode number
  • D — device id
• -T, --type VALUE — specifies the type of objects to look for. VALUE may be a comma separated list of:
  • f — regular file
  • d — directory
  • s — symlink
  • p — FIFO/pipe
  • c — character device
  • b — block device
  • o — socket

default is any. 🎀

• -O, --output VALUE — specifies the output format. VALUE may be a comma separated list of:
  • f — filename
  • p — path
  • d — access description
  • t — element type
  • s — element size (byte)
  • w — watch descriptor (inotify manpage)
  • c — cookie (inotify manpage)
  • m — access mask (inotify manpage | src/fsevents.h)
  • l — len (inotify manpage)
  • A — last access time (e.g. Mon Jul 21 21:32:31 2008)
  • M — last modification time (e.g. Mon Jul 21 21:32:31 2008)
  • S — last status change time (e.g. Mon Jul 21 21:32:31 2008)
  • O — permissions (octal)
  • U — owner (uid)
  • G — group (gid)
  • I — inode number
  • D — device id
  • T — date and time (for this event) (e.g. Tue Mar 25 09:23:16 CET 2008)

e.g.: '[,T,], ,d,:,p,f' would result in:

[Mon Sep  1 12:31:25 2008] file was opened:/etc/passwd

(take a look at the README). 📖✨

• -h, --help — this short help. bestie behaviour fr fr 🫶
• --version — version information. ⭐

---

🌈 little heads-up for the curious ones: the version info block reads version: 0.2.1, build: 2026021610, codename: 25c3, and license: GPL v2+. the original author is Richard Sammet (e-axe) <richard.sammet@gmail.com>. 💜

---

and that's the whole page, bestie 💅 this was FSPY(1) from the User Commands section — the footer calls it Linux filesystem activity mon… and stamps it February 2026. no cap, you're now officially fluent. go watch some files 👑🦋💖