Is it possible to get the filename from an FSEvent id?

Question

I've created a simple filesystem watcher in C++ using the mac File System Events API as documented here: apple developer doc. My question is in the title. How do I get the path of the thing that was changed? The eventPaths array only gives me the path of the parent directory (or set thereof) that I'm essentially watching. But not the underlying directory entry that was modified.

I can grab useful info using the callback, i.e.:

   static void mycallback(
            ConstFSEventStreamRef streamRef,
            void *clientCallBackInfo,
            size_t numEvents,
            void *eventPaths,
            const FSEventStreamEventFlags eventFlags[],
            const FSEventStreamEventId eventIds[])

I'm thinking that perhaps the name can be extracted from one of these items?

EDIT:

For example, one might find that a file is created in which case a

kFSEventStreamEventFlagItemCreated

is raised. But how should I go about getting the actual name of that item? (Similarly for other events, like when an item is deleted etc.).

EDIT 2:

I am starting to think that it won't be possible to do what I want. From FS tech overview:

"The important point to take away is that the granularity of notifications is at a directory level. It tells you only that something in the directory has changed, but does not tell you what changed."

Aka. Bugger.

Cheers,

Ben.

Answer 1

Actually, this is possible, but only on 10.7+. Check out the kFSEventStreamCreateFlagFileEvents flag for FSEventStreamCreate (docs here).

Answer 2

Unfortunately as I discovered, it isn't possible; see FS tech overview for an explanation / motivation. A work-around would be to take a snapshot of the directory and then whenever a change is discovered, take a new snapshot and diff it with the original, to find the specific directory entries (and their names) that changed.

EDIT: It is possible in >=10.7 (See chosen answer)