Filesystem search and inspection

Install

emisar pack install validates the pack and verifies its content hash before copying it into /etc/emisar/packs. The --hash below pins the install to the exact bytes on this page — a tampered copy is rejected. After install, reload the runner; it re-reads the catalog and advertises every action.

content hash: sha256:1b197456f93063f03e04ad96ef704af6c6478783b9244b6e2d16c360e08979a1

sudo emisar pack install fs-search \
  --hash sha256:1b197456f93063f03e04ad96ef704af6c6478783b9244b6e2d16c360e08979a1 \
  --dest /etc/emisar/packs

# Reload so the runner re-reads the catalog:
sudo systemctl reload emisar

• fs.count_lines exec low

  wc -l <file>

• fs.du_top exec low

  du -sh — top N subdirs

• fs.file_type exec low

  file <path>

• fs.find_by_name exec low

  find -name <glob> under <path>

• fs.find_large_files exec low

  Files larger than N MB

• fs.find_recent_modified exec low

  Files modified in last N minutes

• fs.find_setuid exec low

  setuid + setgid files

• fs.find_world_writable exec low

  World-writable files

• fs.grep_file exec low

  grep <pattern> <file>

• fs.grep_recursive exec low

  grep -rE <pattern> <path>

• fs.head_file exec low

  head -n <N> <file>

• fs.ls_long exec low

  ls -la <path>

• fs.sha256_file exec low

  sha256sum <file>

• fs.stat_path exec low

  stat <path>

• fs.tail_file exec low

  tail -n <N> <file>