I'm trying to monitor my /tmp
folder for changes using inotifywatch
:
sudo inotifywatch -v -r /tmp
After creating couple of files (touch /tmp/test-1 /tmp/test-2
), I'm terminating inotifywatch
(by Ctrl–C which shows me the following statistics:
Establishing watches...
Setting up watch(es) on /tmp
OK, /tmp is now being watched.
Total of 39 watches.
Finished establishing watches, now collecting statistics.
total attrib close_write open create filename
8 2 2 2 2 /tmp/
The output only prints the statistics, but not the files I expected (as in here or here). I tried different types of access (via cat
, mktemp
, etc.), but it's the same thing.
Did I miss something?
It's because I'm on VPS and something has been restricted?
OS: Debian 7.3 (inotify-tools) on VPS
Best Answer
This is due to the way you're using
inotifywatch
, and the way the tool itself works. When you runinotifywatch -r /tmp
, you start watching/tmp
and all the files that are already in it. When you create a file inside/tmp
, the directory metadata is updated to contain the new file's inode number, which means that the change happens on/tmp
, not/tmp/test-1
. Additionally, since/tmp/test-1
wasn't there wheninotifywatch
started, there is noinotify
watch placed on it. It means that any event which occurs on a file created after the watches have been placed will not be detected. You might understand it better if you see it yourself:If you have enabled the tracing mechanism on
inotify_add_watch(2)
, the last command will give you the number of watches set up byinotifywatch
. This number should the same as the one given byinotifywatch
itself. Now, create a file inside/tmp
and check again:The number won't have increased, which means the new file isn't watched. Note that the behaviour is different if you create a directory instead :
This is due to the way the
-r
switch behaves:Edit: I got a little confused between your two examples, but in the first case, the watches are correctly placed because the user calls
inotifywatch
on~/*
(which is expanded, see don_crissti's comment here). The home directory is also watched because~/.*
contains~/.
. Theoretically, it should also contain~/..
, which, combined with the-r
switch, should result in watching the whole system.However, it is possible to get the name of the file triggering a create event in a watched directory, yet I'm guessing
inotifywatch
does not retrieve this information (it is saved a little deeper than the directory name).inotify-tools
provides another tool, calledinotifywait
, which can behave pretty much likeinotify-watch
, and provides more output options (including%f
, which is what you're looking for here) :From the man page:
Besides, the
-m
option (monitor) will keepinotifywait
running after the first event, which will reproduce a behaviour quite similar toinotifywatch
's.