macOS script to log xattr changes in realtime, requires `jq`

xattr-watcher.sh

#!/usr/bin/env bash

# watches for changes to xattrs and utimes
# https://github.com/syncthing/syncthing/issues/9371#issuecomment-1937696552
# https://gist.github.com/luckman212/4bb90c65a3470cb11fba49e694dc205f

sudo eslogger --format json setextattr deleteextattr setattrlist utimes | jq -r '
.event as $e |
.process as $p |
($e | keys[0]) as $t |
($p | .executable? | (.path? | split("/")[-1] )) as $x |
[.time, $t, $x, ($e[$t].extattr // ($e[$t].attrlist?|keys?|join(","))), ([($e[$t].target.path),($e[$t].mtime//empty)]|join("->"))] |
@tsv'

syncthing/syncthing#9371 (comment)

Added utimes / mtime logging