Struct es_file_t

#[repr(C)]
pub struct es_file_t {
    pub path: es_string_token_t,
    pub path_truncated: bool,
    pub stat: stat,
}

Available on macOS only.

Provides the stat information and path to a file that relates to a security event. The path may be truncated, which is indicated by the path_truncated flag.

For the FAT family of filesystems the stat.st_ino field is set to 999999999 for empty files.

For files with a link count greater than 1, the absolute path given may not be the only absolute path that exists, and which hard link the emitted path points to is undefined.

Overlong paths are truncated at a maximum length that currently is 16K, though that number is not considered API and may change at any time.

Fields

path: es_string_token_t

Absolute path of the file

path_truncated: bool

Indicates if the path field was truncated

stat: stat

Informations about the file. See man 2 stat for details