Q: Why does it take OverSight, a few seconds to display the webcam/mic usage notification?
A: There is not easy way to determine what process is using the webcam or mic, when either is activated. Worse, there is no direct indication that a new process is accessing an existing a webcam session. Thus OverSight has to perform various tests and has to poll the system (only when the camera/mic is active) in order to determine what process(es) is/are accessing the device. This takes a few seconds...mahalo for your patience!
EDIT: on my iMac M1 the built-in camera and mic are not detectable by MS. So, maybe not...
EDIT2: https://obdev.at/products/microsnitch/releasenotes.html
It's a bug in Big Sur, so hopefully it will be fixed and MS will work again.
It's able to detect camera and microphone activation/deactivation and logs it to stdout. Currently figuring out how to detect when a new peripheral is connected.
I’ve been using this for ~1 and it’s been more reliable than I expected - no maintenance required even with the update to Big Sur.
To save you a click:
log show --predicate 'subsystem == "com.apple.VDCAssistant" && \ eventMessage CONTAINS[c] "kCameraStream"' --last 1m --no-debug --no-pager \ --style compact | tail -n +2)
#or log stream ... # streaming is better to generate events
Which would not work for me as I generally keep the camera off to save bandwidth and the last remaining shreds of my sanity.