I dtruss-ed the dbfseventsd instances, while creating a file in my home directory, and I do see stuff like: 833/0x1c7d: read_nocancel(0x6, "/Users/daniel/

I dtruss-ed the dbfseventsd instances, while creating a file in my home directory, and I do see stuff like: 833/0x1c7d: read_nocancel(0x6, "/Users/daniel/foobarbaz\0", 0x17) = 23 0 833/0x1c7d: access("/Users/daniel/foobarbaz\0", 0x4, 0x17) = 0 0 Same thing for temporary directories (/private/var/folders), Chrome caches, etc. So, at the very least they seem to monitor the whole filesystem for events. Maybe that's even necessary, though: https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/FSEvents_ProgGuide/UsingtheFSEventsFramework/UsingtheFSEventsFramework.html https://developer.apple.com/library/mac/documentation/Darwin... seems to suggest it's not.