From the FAM Manual:
Changes to files and directories are encoded in the FAMEvent structure.
The code field of this structure contains one of the following
enumeration constants:
Changed
Some value which can be obtained with fstat(1) changed for a
file or directory being monitored.
Deleted
A file or directory being monitored was deleted or its name was
changed. This event is also generated when monitoring starts on
a nonexistent file or directory.
StartExecuting
An executable file or shared library being monitored started
executing. If multiple processes execute the same file, this
event only occurs when the first process starts.
StopExecuting
An executable file being monitored which was running finished.
If multiple processes from an executable are running, this event
is only generated when the last one finishes.
Created
A file was created in a directory being monitored. Note: this
event is only generated for files created directly in a
directory being monitored; subdirectories are not automatically
monitored.
Moved FAMMoved events never occur. The name remains defined so that
programs that reference it will still compile.
Acknowledge
After a FAMCancelMonitor, fam generates a FAMAcknowledge event.
Also, if an invalid pathname is specified, fam generates a
FAMAcknowledge event.
Exists
When the application requests a file be monitored, fam generates
a FAMExists event for that file. When the application requests
a directory be monitored, fam generates a FAMExists event for
that directory and every file directly contained in that
directory.
EndExist
When the application requests a file directory be monitored, a
series of FAMExists events is generated as described above.
After the last FAMExists message, fam generates a FAMEndExist
message.
If a FAM event applies to a file or directory being monitored, the
FAMEvent's filename field contains the full pathname that was passed to
fam. If an event applies to an entry in a monitored directory, the
filename field contains the relative path only. For example, if the
directory /usr/tmp/xyzzy were monitored, and the file
/usr/tmp/xyzzy/plugh were deleted, a FAMDeleted event would be generated
containing "plugh" in filename. If the directory itself were deleted,
filename would contain "/usr/tmp/xyzzy".