inotify Usage

wikipedia: inotify is a Linux Kernel subsystem that provides file system event notification. It was written by John McCutchan with help from Robert Love and later Amy Griffis to replace dnotify. It was included in the mainline kernel from release 2.6.13 (2005-06-18).



Kernel configuration:
File Systems ---> [*] Inotify file change notification support

inotify parameters:
$ ls /proc/sys/fs/inotify/
max_queued_events max_user_instances max_user_watches

To install inotify-tools under Debian:
# apt-get install inotify-tools

Simple usage of inotifywait:
$ ls -F
helo helo_d/
$ inotifywait helo
Setting up watches.
Watches established.
helo OPEN
$ inotifywait -m -r helo_d
Setting up watches. Beware: since -r was given, this may take a while!
Watches established.
helo_d/ CREATE hi
helo_d/ OPEN hi
helo_d/ ATTRIB hi
helo_d/ CLOSE_WRITE,CLOSE hi
helo_d/ CREATE,ISDIR dir
helo_d/ OPEN,ISDIR dir
helo_d/ CLOSE_NOWRITE,CLOSE,ISDIR dir
helo_d/dir/ CREATE test
helo_d/dir/ OPEN test
helo_d/dir/ ATTRIB test
helo_d/dir/ CLOSE_WRITE,CLOSE test
helo_d/dir/ DELETE test

Simple usage of inotifywatch:
$ inotifywatch -r helo_d
Establishing watches...
Finished establishing watches, now collecting statistics.
total modify attrib close_write close_nowrite open moved_from moved_to create delete filename
119 4 3 5 45 50 1 1 5 5 helo_d/dir/
99 0 2 2 46 48 0 0 0 1 helo_d/

Events:

• IN_ACCESS: File was accessed (read) (*)
• IN_ATTRIB: Metadata changed (permissions, timestamps, extended attributes, etc.) (*)
• IN_CLOSE_WRITE: File opened for writing was closed (*)
• IN_CLOSE_NOWRITE: File not opened for writing was closed (*)
• IN_CREATE: File/directory created in watched directory (*)
• IN_DELETE: File/directory deleted from watched directory (*)
• IN_DELETE_SELF: Watched file/directory was itself deleted
• IN_MODIFY: File was modified (*)
• IN_MOVE_SELF: Watched file/directory was itself moved
• IN_MOVED_FROM: File moved out of watched directory (*)
• IN_MOVED_TO: File moved into watched directory (*)
• IN_OPEN: File was opened (*)
  

When monitoring a directory, the events marked with an asterisk (*) above can occur for files in the directory, in which case the name field in the returned inotify_event structure identifies the name of the file within the directory.

API:
int inotify_init(void);
int inotify_add_watch(int fd, const char *pathname, uint32_t mask);
int inotify_rm_watch(int fd, uint32_t wd);

Example C code:

#include 
#include 
#include 

int main(void)
{
int fd, wd, sz;
struct inotify_event buf;

if ((fd = inotify_init()) < wd =" inotify_add_watch(fd," sz =" sizeof(struct">

Reference:

• inotify-tools
  
• wikipedia
• linux kernel inotify