Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need a program which generates events when a file is moved, removed or its extended attributes are changed. I'm running Ubuntu Karmic Koala 32-bit desktop.

inotify is the standard solution for such problems, but inotify cannot install a recursive watch, so the only option is to the equivalent of find on the filesystem, and add an inotify watch on each node. This is what e.g. inotifywatch does. This won't work for me, because my filesystem has 1 million files, and installing watches to all of them takes forever.

fanotify could work except that I would have to patch the kernel for that (I'm currently running 2.6.31-20), and maintaining patches to the Linux kernel is beyond my time commitment.

I used to use rfsdelta (whose kernel module is similar to rlocate), but it just doesn't compile on 2.6.31, because it uses obsolete Linux security framework APIs.

I suspect that on-demand antivirus software on Linux might use some other technique I don't know of.

share|improve this question

If you don't have too intense traffic on the structure you want to monitor, you might be interested in iwatch, which takes care of placing listeners recursively.

Careful though, since if file system events are very close AND trying to create a deep structure (ex: a/b/c/d/e/f), you might not pick all the events due to race conditions.

See here for more info:

share|improve this answer
That's a wrapper around inotify. It's therefore bound by the same restrictions, i.e. it cannot handle a million files either. – MSalters Feb 20 '12 at 9:24
True, although it is a one off cost. The real problem (or so it seems to me) is that inotify doesn't support recursive watch. While inotifywatch does provide this feature, it doesn't support action triggers. The correct way to use inotify is not to set a watch on each file but instead on folders anyway and I strongly doubt the OP had 1 million folders. – Guillaume Bodi Feb 21 '12 at 0:41
I need solution which is fast to load (at reboot) and doesn't have race conditions. My filesystem indeed has about 1 million files in 10000 folders. Thus iwatch and inotifywatch don't work for me. – pts Mar 11 '12 at 8:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .