[microtonal]

I dtruss-ed the dbfseventsd instances, while creating a file in my home directory, and I do see stuff like:

    833/0x1c7d:  read_nocancel(0x6, "/Users/daniel/foobarbaz\0", 0x17)		 = 23 0
    833/0x1c7d:  access("/Users/daniel/foobarbaz\0", 0x4, 0x17)		 = 0 0

Same thing for temporary directories (/private/var/folders), Chrome caches, etc. So, at the very least they seem to monitor the whole filesystem for events.

Maybe that's even necessary, though:

https://developer.apple.com/library/mac/documentation/Darwin...

seems to suggest it's not.