Filesystem search and inspection

Install

emisar pack install validates the pack and verifies its content hash before copying it into /etc/emisar/packs. The --hash below pins the install to the exact bytes on this page — a tampered copy is rejected. After install, reload the runner; it re-reads the catalog and advertises every action.

content hash: sha256:5fa6dcb62c5b370cd4147a2a5f8d0dff2beaf62a4158377e3d4763208196052a

sudo emisar pack install fs-search \
  --hash sha256:5fa6dcb62c5b370cd4147a2a5f8d0dff2beaf62a4158377e3d4763208196052a \
  --dest /etc/emisar/packs

# Reload so the runner re-reads the catalog:
sudo systemctl reload emisar

• fs.count_lines exec low

  wc -l <file>

• fs.du_top exec low

  du -sh — top N subdirs

• fs.file_type exec low

  file <path>

• fs.find_by_name exec low

  find -name <glob> under <path>

• fs.find_large_files exec low

  Files larger than N MB

• fs.find_recent_modified exec low

  Files modified in last N minutes

• fs.find_setuid exec low

  setuid + setgid files

• fs.find_world_writable exec low

  World-writable files

• fs.grep_file exec low

  grep <pattern> <file>

• fs.grep_recursive exec low

  grep -rE <pattern> <path>

• fs.head_file exec low

  head -n <N> <file>

• fs.ls_long exec low

  ls -la <path>

• fs.sha256_file exec low

  sha256sum <file>

• fs.stat_path exec low

  stat <path>

• fs.tail_file exec low

  tail -n <N> <file>