title: FSEvents - get PID of the process that performed the operation
body: <p>On OS X, using the <a href="https://developer.apple.com/library/archive/documentation/Darwin/Conceptual/FSEvents_ProgGuide/Introduction/Introduction.html#//apple_ref/doc/uid/TP40005289-CH1-SW1" rel="nofollow noreferrer">FSEvents</a> API, I can easily get file and directory notifications (created, removed, etc), for paths of interest. However, I was wondering if there is any way to get the PID or name of the process that performed the operation (e.g. created the file). I know that you can get this information if you are monitoring the file system in real-time (see: <a href="https://web.archive.org/web/20180924040312/http://osxbook.com/software/fslogger/download/fslogger.c" rel="nofollow noreferrer">fs_logger</a>), but I'd prefer to use <code>FSEvents</code> since it allows you to specific exactly what paths to monitor and works in a callback manner (so likely less CPU intensive?).</p>