fsmon 0.1.5

Lightweight High-Performance File System Change Tracking Tool
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143

pub enum HelpTopic {
    Root,
    Monitor,
    Query,
    Status,
    Stop,
    Start,
    Install,
    Uninstall,
    Clean,
}

pub const fn about(topic: HelpTopic) -> &'static str {
    match topic {
        HelpTopic::Root => "Lightweight high-performance file change tracking tool",
        HelpTopic::Monitor => "Real-time file change monitoring",
        HelpTopic::Query => "Query historical monitoring logs",
        HelpTopic::Status => "Check systemd service status",
        HelpTopic::Stop => "Stop systemd service",
        HelpTopic::Start => "Start systemd service",
        HelpTopic::Install => "Install systemd service",
        HelpTopic::Uninstall => "Uninstall systemd service",
        HelpTopic::Clean => "Clean historical logs",
    }
}

pub const fn long_about(topic: HelpTopic) -> &'static str {
    match topic {
        HelpTopic::Root => "",
        HelpTopic::Monitor => {
            r#"Monitor filesystem events on specified paths, output fanotify raw events in real-time.

[Event Types]
  Default: 8 core change events (CLOSE_WRITE, ATTRIB, CREATE, DELETE, DELETE_SELF, MOVED_FROM, MOVED_TO, MOVE_SELF)
  --all-events: Enable all 14 fanotify events (includes ACCESS, MODIFY, OPEN, OPEN_EXEC, CLOSE_NOWRITE, FS_ERROR)

[Systemd Service]
  Use 'fsmon install' to set up systemd service for long-term monitoring
  fsmon status/stop/start to manage service

[Examples]
  fsmon monitor /etc --types MODIFY          # Investigate config file changes
  fsmon monitor / --all-events               # Enable all 14 event types
  fsmon monitor ~/project --recursive        # Recursively monitor project directory
  fsmon monitor /tmp --min-size 100MB        # Track large file creation
  fsmon monitor /var/log --format json       # JSON format output"#
        }
        HelpTopic::Query => {
            r#"Query historical file change events from log files, supports multiple filter conditions and sorting.

[Time Filtering]
  --since   Start time: relative (1h, 30m, 7d) or absolute ("2024-05-01 10:00")
  --until   End time
  
[Process Filtering]
  --pid     Filter by process ID (multiple supported: 1234,5678)
  --cmd     Filter by process name (wildcard support: nginx*, python)
  --user    Filter by username (multiple supported: root,admin)

[Event Filtering]
  --types     Filter by event type (ACCESS,MODIFY,CREATE,DELETE,...)
  --min-size  Filter by size change (e.g., 100MB, 1GB)

[Examples]
  fsmon query                              # Query default log (~/.fsmon/history.log)
  fsmon query --since 1h                   # Last 1 hour
  fsmon query --cmd nginx                  # Only nginx operations
  fsmon query --since 1h --cmd java --types MODIFY --min-size 100MB  # Combined filters
  fsmon query --format json --sort size    # JSON output, sorted by size"#
        }
        HelpTopic::Status => {
            r#"Check fsmon systemd service status.

[Output Content]
  - Service status (active/inactive/failed)
  - Use 'systemctl status fsmon' for detailed information

[Examples]
  fsmon status"#
        }
        HelpTopic::Stop => {
            r#"Stop fsmon systemd service.

[Examples]
  fsmon stop"#
        }
        HelpTopic::Start => {
            r#"Start fsmon systemd service.

[Examples]
  fsmon start"#
        }
        HelpTopic::Install => {
            r#"Install fsmon as a systemd service.

[Service Configuration]
  - Creates /etc/systemd/system/fsmon.service
  - Configures auto-restart on failure
  - Logs to systemd journal

[Examples]
  fsmon install /var/log -o /var/log/fsmon.log    # Monitor /var/log
  fsmon install /etc /var/log                      # Monitor multiple paths"#
        }
        HelpTopic::Uninstall => {
            r#"Uninstall fsmon systemd service.

[Actions]
  - Stops service if running
  - Disables service
  - Removes service file

[Examples]
  fsmon uninstall"#
        }
        HelpTopic::Clean => {
            r#"Clean historical log files, retain by time or size.

[Cleanup Strategy]
  --keep-days   Keep logs from last N days (default: 30 days)
  --max-size    Limit maximum log file size (e.g., 100MB, 1GB)
  --dry-run     Preview mode, don't actually delete

[Examples]
  fsmon clean --keep-days 7           # Keep 7 days of logs
  fsmon clean --max-size 100MB        # Limit logs to 100MB
  fsmon clean --keep-days 7 --dry-run # Preview without deleting"#
        }
    }
}

pub const fn after_help() -> &'static str {
    r#"Use 'fsmon <COMMAND> --help' for detailed command info

Examples:
  fsmon monitor /var/log                     # Basic monitoring
  fsmon monitor /etc --types MODIFY         # Investigate config file changes
  fsmon monitor / --all-events               # Enable all 14 event types
  fsmon monitor ~/project --recursive       # Recursively monitor project
  fsmon install /var/log -o /var/log/fsmon.log  # Install systemd service
  fsmon query --since 1h --cmd nginx         # Query nginx operations in last hour
  fsmon status                               # Check service status"#
}