https://github.com/burnshall-ui/ocwatch
Inotify-based write monitor for OpenClaw agents. Build on Arm64 architecture and linux.
https://github.com/burnshall-ui/ocwatch
agent agentic-ai agents openclaw zig
Last synced: about 1 month ago
JSON representation
Inotify-based write monitor for OpenClaw agents. Build on Arm64 architecture and linux.
- Host: GitHub
- URL: https://github.com/burnshall-ui/ocwatch
- Owner: burnshall-ui
- Created: 2026-04-16T23:49:45.000Z (2 months ago)
- Default Branch: main
- Last Pushed: 2026-04-28T00:52:39.000Z (about 2 months ago)
- Last Synced: 2026-04-28T01:23:42.313Z (about 2 months ago)
- Topics: agent, agentic-ai, agents, openclaw, zig
- Language: Zig
- Homepage:
- Size: 9.77 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# ocwatch
Filesystem write monitor for [OpenClaw](https://openclaw.dev) agents. Uses Linux `inotify` to watch `~/.openclaw/` recursively and logs every write, atomic rename, and delete with millisecond timestamps.
```
2026-04-17T01:42:22.263 START watching /root/.openclaw (62 dirs) → ocwatch.log
2026-04-17T01:48:03.891 RENAME-TO /root/.openclaw/openclaw.json [7027B]
2026-04-17T01:48:03.892 RENAME-FROM /root/.openclaw/openclaw.json.tmp
2026-04-17T01:51:17.440 WRITE /root/.openclaw/workspace/memory/2026-04-17.md [1842B]
2026-04-17T01:55:00.012 DELETE /root/.openclaw/workspace/.tmp_session_abc123
```
## Why
OpenClaw agents perform config writes as atomic renames (temp → final). Catch exactly that — plus session files, memory writes, and dream cycles — without polling.
## Requirements
- Linux (uses `inotify`, `getdents64`, `statx`)
- [Zig](https://ziglang.org) 0.16+ to build
- No libc dependency
## Build
```sh
zig build -Doptimize=ReleaseFast
```
Binary lands at `zig-out/bin/ocwatch`.
## Install
```sh
cp zig-out/bin/ocwatch ~/.local/bin/
```
## Usage
```
ocwatch [watch-dir] [log-file]
```
| Argument | Default |
|-------------|--------------------------------------|
| `watch-dir` | `/root/.openclaw` |
| `log-file` | `/root/.openclaw/logs/ocwatch.log` |
Output goes to **both stdout and the log file** simultaneously.
## Run as a service
```sh
# ~/.config/systemd/user/ocwatch.service
[Unit]
Description=OpenClaw Agent Write Monitor
After=openclaw-gateway.service
[Service]
ExecStart=/root/.local/bin/ocwatch /root/.openclaw /root/.openclaw/logs/ocwatch.log
Restart=on-failure
RestartSec=5
[Install]
WantedBy=default.target
```
```sh
systemctl --user enable --now ocwatch
```
## Event types
| Event | Meaning |
|---------------|---------------------------------------------------|
| `WRITE` | File closed after write (`IN_CLOSE_WRITE`) |
| `RENAME-TO` | File renamed here — openclaw's atomic write pattern |
| `RENAME-FROM` | Source side of a rename |
| `DELETE` | File removed |
| `DELETE-SELF` | Watched directory removed |
New subdirectories are picked up automatically at runtime — no restart needed.
## Log format
```
[B]
```
Size is shown for `WRITE` and `RENAME-TO` events via `statx(2)`.
## License
MIT