Where Does FileMonitor Store Rules on Mac?
Where FileMonitor keeps file event rules and logs on Mac for review, backup and full migration.
Last updated
FileMonitor watches file writes with rules and event logs under the Objective-See vendor folder: watched paths plus triggered event history. A helper outside the bundle records them.
Copy data with monitoring paused; the helper reinstalls per Mac and permissions never travel. Reach Library through Go to Folder. Logs rotate on their own schedule, so export incidents worth keeping for audits and reviews.
Where FileMonitor stores this, by platform
~/Library/Application Support/Objective-See/FileMonitor
Rules and event history under the vendor folder in Library. Helper reinstalls per Mac. Export incidents before rotation prunes them.
Frequently asked questions
How do I move FileMonitor to a new Mac?
Copy the Objective-See data folder with monitoring paused, then reinstall the helper on the new Mac. Rules travel in files; enforcement needs the fresh install. Re-grant Full Disk Access after restoring.
Where are FileMonitor events on disk?
Open FileMonitor console and read the flagged writes; the files mirror them. Rules live under the vendor folder in Library. The console always shows the live set.
Notice an outdated path? Let us know.