I need to monitor a directory and do some post actions based on the events happened. I am familiar with inotifywait but since we use docker based on alpine, I was thinking about is there other way to do that. Then I found Inotifyd , according to the document there said "While there are tools designed around inotify (inotify-tools) alpine has a build in tool called inotifyd (part of busybox) to execute a command on file system events." But the problem are, a) according that alpine document setting inotifyd to work seems quite complicated compared to inotifywait b) I can't find many articles about inotifyd. So I get the feeling that it is not widely-used. So can someone with experience of Inotifyd shed some light on this ?

When I use incrontab out of the box, I mean no changes, I get no result, as if the command was not executed. my incron line is : /crrae IN_CREATE,IN_CLOSE_WRITE,IN_MOVED_TO /usr/bin/unix2dos $# the log give information as if everything was ok but no actually the strace generated is: incrontab_trace_0.txt 0.000000 poll([{fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=8, events=POLLIN}], 3, -1) = 1 ([{fd=8, revents=POLLIN}]) 17.616276 read(8, "\1\0\0\0\0\1\0\0\0\0\0\0000\0\0\0ExportSageJDE_CO"..., 32768) = 64 0.000145 stat64("/crrae", {st_mode=S_IFDIR|0777, st_size=4096, ...}) = 0 0.000147 time(NULL) = 1399228077 0.000056 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=156, ...}) = 0 0.000089 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=156, ...}) = 0 0.000082 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=156, ...}) = 0 0.000096 send(3, "May 4 18:27:57 incrond[3183"..., 108, MSG_NOSIGNAL) = 108 0.000104 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7f60718) = 31838 0.000816 poll([{fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=8, events=POLLIN}], 3, -1) = -1 EINTR (Interrupted system call) 0.000834 --- SIGCHLD (Child exited) @ 0 (0) --- 0.000033 read(4, 0x8069c40, 32) = -1 EAGAIN (Resource temporarily unavailable) 0.000057 write(5, "X", 1) = 1 0.000056 sigreturn() = ? (mask now []) 0.000072 poll([{fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=8, events=POLLIN}], 3, -1) = 1 ([{fd=4, revents=POLLIN}]) 0.000068 read(4, "X", 1) = 1 0.000054 read(4, 0xbfd22dd9, 1) = -1 EAGAIN (Resource temporarily unavailable) 0.000057 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], WNOHANG) = 31838 0.000060 waitpid(-1, 0xbfd22dd4, WNOHANG) = -1 ECHILD (No child processes) 0.000051 poll([{fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=8, events=POLLIN}], 3, -1) = 1 ([{fd=8, revents=POLLIN}]) 0.009198 read(8, "\1\0\0\0\10\0\0\0\0\0\0\0000\0\0\0ExportSageJDE_CO"..., 32768) = 64 0.000074 stat64("/crrae", {st_mode=S_IFDIR|0777, st_size=4096, ...}) = 0 0.000118 time(NULL) = 1399228077 0.000057 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=156, ...}) = 0 0.000084 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=156, ...}) = 0 0.000082 stat64("/etc/localtime", {st_mode=S_IFREG|0644, st_size=156, ...}) = 0 0.000090 send(3, "May 4 18:27:57 incrond[3183"..., 108, MSG_NOSIGNAL) = 108 0.000065 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7f60718) = 31839 0.000614 poll([{fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=8, events=POLLIN}], 3, -1) = -1 EINTR (Interrupted system call) 0.000832 --- SIGCHLD (Child exited) @ 0 (0) --- 0.000026 read(4, 0x8069c40, 32) = -1 EAGAIN (Resource temporarily unavailable) 0.000055 write(5, "X", 1) = 1 0.000054 sigreturn() = ? (mask now []) 0.000071 poll([{fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=8, events=POLLIN}], 3, -1) = 1 ([{fd=4, revents=POLLIN}]) 0.000067 read(4, "X", 1) = 1 0.000053 read(4, 0xbfd22dd9, 1) = -1 EAGAIN (Resource temporarily unavailable) 0.000051 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], WNOHANG) = 31839 0.000058 waitpid(-1, 0xbfd22dd4, WNOHANG) = -1 ECHILD (No child processes) 0.000050 poll([{fd=4, events=POLLIN}, {fd=6, events=POLLIN}, {fd=8, events=POLLIN}], 3, -1 When I change my incron to: /crrae IN_CREATE,IN_CLOSE_WRITE,IN_MOVED_TO /usr/bin/unix2dos /crrae/$# or /crrae IN_CREATE,IN_CLOSE_WRITE,IN_MOVED_TO /usr/bin/unix2dos $@/$# the log gives me this: May 4 18:15:10 srvovs incrond: (root) CMD (/usr/bin/unix2dos /crrae/u2dtmpPbqoFd) May 4 18:15:10 srvovs incrond: (root) CMD (/usr/bin/unix2dos /crrae/u2dtmpN2Odxf) May 4 18:15:10 srvovs incrond: (root) CMD (/usr/bin/unix2dos /crrae/u2dtmpN2Odxf) multiple times, the incron.conf has not been modified. Any ideas?

Summary: I need to automatically backup files on a hidden hard disk whenever the user copy files on a specific hard disk. Long explanation: Context: My father (70 years old) is very bad at computers. He barely knows how to copy and paste with a graphical interface, nothing more. I have installed him a linux mint distro which I have tailored so he doesn't crash it and understand easily. He use his computer mostly to save his photographies: around 2TB now... I plan to install him an extra hard disk called "photos" so he can discharge his photos on it. I also plan to put another disk ("photocopie") as a backup so in case the first hard disk crash, he will not lost his photographies. I will make this second hard disk hidden so my dad doesn't fuss with it. I would like to know how to automatically copy the new photos he adds on the hard disk "photos" to the second one "photocopies"; he only do how to do this using caja (Mate file manager). I had first read about using raid 1 but it doesn't seems to be the proper solution. Some suggested using rsync with cron, however cron work at specific times, and since my dad doesn't use his computer often, it may not work properly. I was trying to find an app that would start at a specific event such as "if files are written on hard disk photos, then run rsync as incremental on the hard disk photocopie", but I couldn't find an app detecting events. I have read about inotifywait, could it be the solution? How to implement that? PS: the photo sources could be anything than can be plugged by USB: a camera, an smartphone (Apple). My dad usually run caja and copy past from the phone to the proper directory/hard disk.

I have been running inotify-wait on my ftp server in byobu to monitor a folder, move data, and send email notifications for a few months without problems. Since I started this I have added 3 more folders that I monitor and I would like to start running inotify-wait as a daemon instead of in byobu sessions. I modified my script to be easier to only require a single variable to be changed and to run as a daemon. Unfortunately it now does nothing. I was hoping someone with some experience could take a look and tell me where Ive gone wrong. #!/usr/bin/env bash user=testuser dir=/ftp/"$user"/upload/ log=/ftp/"$user"/log/"$user.log" archive=/ftp/"$user"/archive/ target=/ftp/FTPDATA/"$user"/ inotifywait -q\ -d "$dir" \ -o "$log" \ -e close_write --format %f . | while IFS= read -r file; do cp -p "$file" "$target" /scripts/"$user-notify.sh" mv "$file" "$archive""$(date +%F-%T)" done

I use inotifywait for event trigger which put file. When many files are watched by inotifywait, when max_user_watches is exceeded, the following error occurs. >Terminating since out of inotify watches.#012Consider increasing /proc/sys/fs/inotify/max_user_watches It is necessary to tune /proc/sys/fs/inotify/max_user_watches, but is it possible to check the current file watch number? Is there a way to check like *file-nr* in file descriptor?

a beginner here. I am trying to write a script so that when a file (called "file1" for example) is created in a directory, I can see a notification and the inotifywait command I am using is stopped. so far, after I saw several examples this is the code I have: #!/bin/bash DIRECTORY="$PWD" inotifywait -m -e create --format '%f' "$DIRECTORY" | while read FILENAME; do echo "File created: $FILENAME" if [ -f file1 ]; then exit fi done But the code doesn't exit the script after file1 is created. The inotify command continue to run until I press ctrl+C. What do I need to do in order for the code to exit on time? also, is there a way to run it in the background while I continue with other work on the same terminal? Because it seems like the command is running on the terminal and if I want to use the command line I have to terminate the script.

I have a rather unique setup: Proxmox setup with 2x fileservers (Debian 12), running DRBD for redundancy, XFS as the main data filesystem and then an NFS share set up for our 6 node cluster to access. Guests are then spread out across 6 nodes and have the NFS share mounted on each guest as /data As this data is weather data, there are hundreds of millions of files that we now have in the archive side of things in /data/archive. We are doing multiple offsite backups to different locations and have the archive backups job set seperately to the main backup job as it's taking 12-13 hours each night to complete via rsync. The backup destinations are going to offsite synology NAS's. I currently have a script set up on the fileservers to watch /data (currently excluding archives) using inotifywait to log all file changes/deletions to a postgres database. This makes it really fast and easy for cleanup scripts and backups to run. The issue I have is that I also want to apply this to archives, but given there are millions of directories and hundreds of millions of files, that would result in an enormous amount of watches being required on the system and would take hours to set up the initial watches (as it is now with the non archive data it is taking up to 30 minutes to set up watches). So far I have had a look at the following with not much luck as it seems DRBD + NFS doesn't have many logging options: creating a custom fa_notify app in C/C++ - this would work fine for a local path but seems that fa_notify has no support for NFS mount points. Loggedfs - had limited success with this, could log file creations/updates but didn't log the names of deletions fatrace - similar to loggedfs bpftrace - worked ok on a client nfs mount for most operations however only logs relative paths (eg cd /data and then touch test.txt would result in a logged entry for test.txt instead of /data/test.txt). Custom fuse passthrough C app on each client that logs to the postgres db - worked but had extremely poor performance and was a massive bottleneck. Often spiked well over 10 threads under load. Also stopping the app would make any apps that had a handle on /data invalid and they would crash due to /data fuse mount point disappearing. auditctl/auditd - way too verbose and with huge amounts of writes going on, was rotating logs multiple times a minute and placing huge IO on the guest I was testing it on. It seems I am at the mercy of fa_notify not working for NFS/DRBD and inotifywait not being an option due to the huge number of watches... Is this a pipedream to be able to monitor in realtime any changes to /data/archive to a postgres db and then just fetch the last 24 hours of files that way for backups, or am I really overthinking this and it's something stupidly obvious. Thanks guys, I'm really pulling my hair out over this one because archives is only going to keep growing. Cheers, Mike

How to watch for sysfs file changes (like /sys/class/net/eth0/statistics/operstate) and execute a command on content change? - inotify does not work on sysfs - I don't want to poll. I want to set a listener with a callback routine once

I am consistently running out of inotify resources, leading to errors along the lines of: # tail -f /some/files tail: inotify resources exhausted tail: inotify cannot be used, reverting to polling This eventually happens even if I grow the value of fs.inotify.max_user_watches. I suspect a locally installed Java application is consuming the resources, but I don't have the option of either fixing it or removing it. Is there a way to set a limit on the number of inotify watches that can be consumed by a process?

I am using this command to watch a directory: inotifywait -r -e modify,create,delete --exclude ".*(\.(git|idea)|(.*(___jb_tmp___|___jb_old___)))" my-dir However, it does not work like I intend. What I want is that it does only NOT fire if every file that was changed is excluded. If there is at least one file that is NOT excluded and changes, then I want inotifywait to "fire". My overall plan is to push code to a remove server whenever a python file or something else that is relevant is changed. I do not want to push code when only meta files from my IDE (PyCharm) or git files are changed. Is there a way to do this? Right now inotifywait does not fire when I change a python file in PyCharm since there are some files changed that end with ___jb_tmp___. However, if I change a python file by hand, it works (e.g. in nano or vim).

I'd like to start a process a few seconds after a directory has been modified, batching processing of multiple files. If I define a systemd path unit, my "service" is started immediately after the first file is created. This will lead to eventual consistency, but is suboptimal: - the first process starts processing the first file - the second and further processes are held up waiting for a lockfile - after processing the first file completes, another process gets the lock, processes the remaining files as a batch - then the remaining processes acquire the lock one after the other, find the directory empty, and exit What I'd like to do is, after the first notification is received, wait for five seconds without a notification, then start the process. If more files are created afterwards, the process should be run a second time after the first instance finishes. Because the process removes the files from the watched directory, deletion notifications will be generated during a successful run. I'm okay with running the process a second time if only deletions are received, but ideally I'd like to skip that as well. Can I do this with systemd, or do I need to dust off some old Unix tool?

When I run a command in a container, I'm getting inotify_init1() failed: Too many open files How can I see how many inotify watchers I have open and what's holding them open?

I want to automatize a job, i.e. the conversion of videos (taken by mobile phones) with ffmpeg on my nextcloud server. The bashscript I run manually runs fine: #!/bin/bash for i in *.3gp *.avi *.m4v *.mp4 *.mov *.3GP *.AVI *.M4V *.MP4 *.MOV; do if [ "${i: -8}" != "conv.mp4" ]; then echo $i fi done curdir1=$(pwd | sed "s|/mnt/red_8tb/data||") curdir2=$(echo $curdir1 | sed 's|/[^\/]*$||') mkdir -p originals for i in *.3gp *.avi *.m4v *.mp4 *.mov *.3GP *.AVI *.M4V *.MP4 *.MOV; do if [ "${i: -8}" != "conv.mp4" ]; then sudo nice -19 ffmpeg -threads 1 -benchmark -i "$i" -qscale:v 0 -movflags '+faststart +use_metadata_tags' "${i%.*}_conv.mp4" mv "$i" originals fi done sudo chown -R www-data:www-data * echo "$curdir2" sudo -u www-data php /var/www/nextcloud/occ files:scan -p "$curdir2" Since my family also uses the nextcloud, and the +faststart option is so desirable, I wrote this code to use inotifywait to enable them do the conversion themself/automatically, i.e. triggered by moving/uploading videos into a specific directory:

#!/bin/bash

inotifywait -m /mnt/red_8tb/data/Beres/files/originals/WORKLIST_VIDEOS -e create -e moved_to | \
  while read directory action file; do
    if [[ "${file: -8}" != "conv.mp4" ]]; then
      if [[ "${file: -4}" == ".3gp" || "${file: -4}" == ".avi" || "${file: -4}" == ".m4v" || "${file: -4}" == ".mov" || "${file: -4}" == ".mp4" || "${file: -4}" == ".3GP" || "${file: -4}" == ".AVI" || "${file: -4}" == ".M4V" || "${file: -4}" == ".MOV" || "${file: -4}" == ".MP4" ]]; then
        echo "$directory""$file"
        sleep 5s
        sudo nice -19 ffmpeg -threads 1 -i "$directory""$file" -qscale:v 0 -movflags '+faststart +use_metadata_tags' "$directory"/test/"${file%.*}_conv.mp4"
        sudo chown -R www-data:www-data "$directory"/test/"${file%.*}_conv.mp4"
        curdir1=$(echo "$directory" | sed "s|/mnt/red_8tb/data||")
        curdir2=$(echo $curdir1 | sed 's|/[^\/]*$||')
        sudo -u www-data php /var/www/nextcloud/occ files:scan -p "$curdir2"
      fi
    fi
  done

Unfortunately, only one video gets converted when I move several. If I move another video into the directory, after (!) ffmpeg finishes, this new video also gets converted, so the script is not "stuck", yet fails to loop through multiple files. Other operations, e.g. moving the files into a directory, work as intended. btw: I am aware of this question: https://unix.stackexchange.com/questions/724480/use-inotifywait-to-handle-multiple-files-at-the-same-time?rq=1 , but it doesn't seem to help :-(

How can I detect changes on a mounted NAS? It is mounted via fstab:

//fritz.box/FRITZ.NAS /media/fritz cifs username=foo,password=bar,vers=1.0 0 0

Since I tried entr and inotify to no avail, I'm happy to any scripted suggestions e.g. polling va systemd.timer etc. Aparently watching a NAS needs special care (inode).

I want to use inotifywait to run code upon the creation of a file with a known fixed filename. [This answer](https://stackoverflow.com/a/70133285/3499840) correctly explains that I cannot run inotifywait *directly* against a file that does not yet exist and that instead, I should run inotifywait against the parent directory, with an include argument that contains a suitable regex to match the specified filename. If I use the regular expression that that answer suggests, however, I find that other filenames match: inotifywait -m -e close_write --format %f --include 'hello\.txt' . # (Then, in another terminal...) touch hello.txt # Prints hello.txt - this is good. touch ahello.txt # Prints ahello.txt - this is bad. touch hello.txta # Prints hello.txta - this is bad. touch ahello.txta # Prints ahello.txta - this is bad. "That's easy to fix", I say to myself. "I'll just add in the usual metacharacters to mark the start and end of the string." inotifywait -m -e close_write --format %f --include '^hello\.txt$' . # (Then, in another terminal...) touch ahello.txta # Prints nothing - this is good. touch ahello.txt # Prints nothing - this is good. touch hello.txta # Prints nothing - this is good. touch hello.txt # Prints nothing - this is bad. man inotifywait clearly states --include will "process events only for the subset of files whose filenames match the specified POSIX regular expression, case sensitive." and I can see the filenames (as inotifywait sees them) printed in the first block of code above: when I typed in touch hello.txt, inotifywait printed hello.txt so I know that inotifywait thinks that the filename is hello.txt. Why is my regular expression ^hello\.txt$ not matching the filename hello.txt? What should I be using instead?

I want to run inotifywait to watch for all CREATEs of .txt files (recursively) under, let's say, the current directory. I run the following: inotifywait -mr --event create --format '%e %w %f' --include '\.txt$' . In another shell (from the same directory), I run the following: touch 1.txt # inotifywait prints "CREATE ./ 1.txt" - all good. mkdir mydir # inotifywait prints nothing - all good. cd mydir # inotifywait prints nothing - all good. touch 1.txt # inotifywait prints nothing - NOT GOOD. I should have seen a "CREATE" message. So despite me including the -r option (for which man inotifywait clearly states "*Newly created subdirectories will also be watched.*"), my newly created subdirectory is clearly **not** being watched. Is this: 1. a bug in inotifywait? 2. an error in my --include regex? 3. something else? (FWIW, I'm running Debian GNU/Linux 12 (bookworm) and inotify-tools v3.22.6.0-4.)

I have seen [this answer](https://unix.stackexchange.com/questions/24952/script-to-monitor-folder-for-new-files#answer-24955) : > You should consider using inotifywait, as an example: > > inotifywait -m /path -e create -e moved_to | > while read path action file; do > echo "The file '$file' appeared in directory '$path' via '$action'" > # do something with the file > done The above script watches a directory for creation of files of any type. My question is how to modify the [inotifywait](https://www.man7.org/linux/man-pages/man1/inotifywait.1.html) command to report only when a file of a certain type/extension is created (or moved into the directory). For example, it should report when any .xml file is created. **What I tried**: I have run the inotifywait --help command, and have read the command line options. It has --exclude and --excludei options to *EXCLUDE* files of certain types (by using regular expressions), but I need a way to *INCLUDE* just the files of a certain type/extension.

I have written a small 'daemon' in bash that will switch to the headphones if they are detected, and if not, switch to an external USB speaker with PulseAudio. What I'm looking for is some way to get notification of changes on the file /proc/asound/card0/codec#0, just like inotifywait does on real files (considering files under /proc to be as "pseudo-files"). I find my code a bit insane, because it runs sleep 1 with awk for the whole day, that is 86400 times a day :) while sleep 1; do _1=${_2:-} _2=$(awk '/Pin-ctls/{n++;if(n==4)print}' '/proc/asound/card0/codec#0') [[ ${_1:-} = $_2 ]] || if [[ $_2 =~ OUT ]]; then use_speakers else use_internal fi done What I'm looking for is something like (this example doesn't work): codec=/proc/asound/card0/codec#0 while inotifywait $codec; do if [[ $(awk '/Pin-ctls/{n++;if(n==4)print}' $codec) =~ OUT ]]; then use_speakers else use_internal fi done This way the commands inside the loop would be run only when there are real changes on the $codec file.

I'd like to monitor a file with inotify, and trigger some code when someone changes the content (IN_MODIFY or IN_CLOSE_WRITE), but I'm running into problems where inotify stops returning events when users edit the file with their favorite tool. The file is meant to be simple (single line, no spaces, max 20 characters). I'd rather not restrict their usage, but I'm not sure how to handle different situations. I'm using inotify and these are the events that I receive when various applications edit the file: | Action | inotify Events | |--------|----------------| | touch file | IN_OPEN | | echo "data" > file | IN_MODIFY, IN_OPEN, IN_ACCESS, then IN_CLOSE_NOWRITE | | nano file (on open) | IN_OPEN | | nano file (on ^O) | IN_MODIFY, IN_CLOSE_WRITE, IN_OPEN, IN_ACCESS | | vim file (on open) | IN_OPEN, IN_CLOSE_NOWRITE | | vim file (on :w) | IN_MOVE_SELF, IN_ATTRIB, then events stop coming from this file | | gedit file (on open) | IN_OPEN, IN_CLOSE_NOWRITE, IN_ACCESS | | gedit file (on save) | IN_OPEN, IN_CLOSE_WRITE, IN_ATTRIB, then events stop coming from this file | | mv newfile file | IN_ATTRIB, then events stop coming from this file | At one point I thought I saw gedit trigger also trigger IN_DELETE_SELF before going silent. In the case where a user uses vim and gedit, I stop getting inotify events after the user has finished the edits. How should I deal with this? The only thing I see in common is the IN_ATTRIB event. I suspect that when I receive the IN_ATTRIB event, I should inotify_rm_watch() that wd, and then re-create a new inotify_add_watch() based on the same path. But is that the correct approach? Another option could be to watch the parent directory. The affected file name is included in the inotify_event::name, and so I could filter on the file of interest, and trigger off of any IN_MODIFY or IN_CLOSE_WRITE where the name matches my file of interest.

We have a C++ program, that logs its messages into a file. Every once in a while the directory containing this log-file is renamed (or even deleted), and a folder with the same name is created anew. How would the daemon detect this happening -- so that it can reopen its log? That is, I know, I can do it using inotify (or, more generally, with [libevent](https://libevent.org/)) , but is there, perhaps, anything simpler? Our Python programs use the logging.handlers.WatchFileHandler() -- is there something like that for C++? I don't need to know about the change immediately -- only when the program has a new message to write out...