fseventsd (File System Events Daemon) is a safe macOS storage process. fseventsd is the macOS daemon that monitors and records file system changes in real time. It maintains a persistent log of which directories have been modified, enabling applications like Spotlight, Time Machine, and backup utilities to efficiently detect changes without scanning entire volumes. The event data is stored in .fseventsd directories at the root of each volume. fseventsd using resources during and shortly after file system changes is completely normal behavior. Be concerned if fseventsd shows sustained high CPU with no visible file operations occurring — this could indicate filesystem corruption, a runaway process writing temporary files very rapidly, or a potential rootkit trying to manipulate file system event logs.
File System Events Daemon
fseventsd is the macOS daemon that monitors and records file system changes in real time. It maintains a persistent log of which directories have been modified, enabling applications like Spotlight, Time Machine, and backup utilities to efficiently detect changes without scanning entire volumes. The event data is stored in .fseventsd directories at the root of each volume.
High CPU during rapid file system changes like large builds or extractions
.fseventsd directory growing very large on frequently modified volumes
Event delivery delays causing Spotlight or backup tools to miss changes
Disk activity from fseventsd on external drives when first connected
During large file operations (extracting archives, building projects, restoring backups), fseventsd will use more resources to log all changes. This is temporary. Wait for the file operation to finish, and fseventsd usage will return to near zero.
If the .fseventsd directory on a volume has grown very large, you can clear it by running 'sudo rm -rf /path/to/volume/.fseventsd' and then restarting. Note: this forces a full re-scan for Spotlight and Time Machine on that volume.
Create a file named '.fseventsd/no_log' at the root of a volume to prevent fseventsd from recording events on that volume. This is useful for scratch disks or temporary volumes that don't need change tracking.
Persistent high fseventsd activity can indicate filesystem issues. Open Disk Utility, select the affected volume, and run First Aid to check and repair filesystem errors that might be causing excessive event generation.
fseventsd using resources during and shortly after file system changes is completely normal behavior. Be concerned if fseventsd shows sustained high CPU with no visible file operations occurring — this could indicate filesystem corruption, a runaway process writing temporary files very rapidly, or a potential rootkit trying to manipulate file system event logs.
CoreLock leverages fseventsd's file system event stream to detect unauthorized file modifications in real time. It monitors critical system directories for unexpected changes and can alert you when files are being modified by processes that shouldn't have access to them.
Download CoreLock Freemds_stores is a core macOS system process responsible for maintaining the Spotlight search index. It reads file metadata...
mdworker is a helper process spawned by the Spotlight metadata server (mds). While mds_stores manages the search index d...
bird (sometimes called 'birdd') is the macOS daemon responsible for syncing files between your Mac and iCloud Drive. It ...
fseventsd is the file system events daemon that monitors all file changes on your Mac in real time. It maintains a lightweight log of which directories have been modified, so applications like Spotlight, Time Machine, and third-party backup tools can efficiently detect what's changed since their last scan without checking every file.
You can safely delete the .fseventsd folder on any volume, but this forces Spotlight and Time Machine to do a full re-scan of that volume on next use. The folder will be recreated automatically. On your boot volume, expect a brief period of higher resource usage while the change log is rebuilt.
Yes. fseventsd is a core Apple system process that has been part of macOS since OS X Leopard (10.5). It provides the file change monitoring infrastructure that Spotlight search, Time Machine backups, and many other macOS features depend on. It is code-signed by Apple and protected by System Integrity Protection.
Download CoreLock to identify suspicious processes, detect threats, and keep your Mac running smoothly.
Download CoreLock FreeAvailable for macOS and Windows