up vote 0 down vote favorite
1
share [g+] share [fb]

I need a program which generates events when a file is moved, removed or its extended attributes are changed. I'm running Ubuntu Karmic Koala 32-bit desktop.

inotify is the standard solution for such problems, but inotify cannot install a recursive watch, so the only option is to the equivalent of find on the filesystem, and add an inotify watch on each node. This is what e.g. inotifywatch does. This won't work for me, because my filesystem has 1 million files, and installing watches to all of them takes forever.

fanotify could work except that I would have to patch the kernel for that (I'm currently running 2.6.31-20), and maintaining patches to the Linux kernel is beyond my time commitment.

I used to use rfsdelta (whose kernel module is similar to rlocate), but it just doesn't compile on 2.6.31, because it uses obsolete Linux security framework APIs.

I suspect that on-demand antivirus software on Linux might use some other technique I don't know of.

link|improve this question
65% accept rate
feedback

2 Answers

up vote 0 down vote accepted

Since I didn't get an answer for a long time, most probably there is no such tool I'm looking for.

link|improve this answer
feedback
up vote 0 down vote

If you don't have too intense traffic on the structure you want to monitor, you might be interested in iwatch, which takes care of placing listeners recursively.

http://iwatch.sourceforge.net/index.html

Careful though, since if file system events are very close AND trying to create a deep structure (ex: a/b/c/d/e/f), you might not pick all the events due to race conditions.

See here for more info:

http://old.nabble.com/Bug-494397%3A-iwatch%3A-New-subdirectories-in-recursive-mode-won%27t-be-recognized-p27145632.html

link|improve this answer
That's a wrapper around inotify. It's therefore bound by the same restrictions, i.e. it cannot handle a million files either. – MSalters Feb 20 at 9:24
True, although it is a one off cost. The real problem (or so it seems to me) is that inotify doesn't support recursive watch. While inotifywatch does provide this feature, it doesn't support action triggers. The correct way to use inotify is not to set a watch on each file but instead on folders anyway and I strongly doubt the OP had 1 million folders. – Guillaume Bodi Feb 21 at 0:41
I need solution which is fast to load (at reboot) and doesn't have race conditions. My filesystem indeed has about 1 million files in 10000 folders. Thus iwatch and inotifywatch don't work for me. – pts Mar 11 at 8:11
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.