Best Way to Monitor File System Changes in Linux

How to monitor a complete directory tree for changes in Linux?

To my knowledge, there's no other way than recursively setting an inotify watch on each directory.

That said, you won't run out of file descriptors because inotify does not have to reserve an fd to watch a file or a directory (its predecessor, dnotify, did suffer from this limitation). inotify uses "watch descriptors" instead.

According to the documentation for inotifywatch, the default limit is 8192 watch descriptors, and you can increase it by writing the new value to /proc/sys/fs/inotify/max_user_watches.

On linux, how to monitor the change of a file/directory, by system call or shell command?

The equivalent Linux API is inotify:

The inotify API provides a mechanism for monitoring file system events. Inotify can be used to monitor individual files, or to monitor directories. When a directory is monitored, inotify will return events for the directory itself, and for files inside the directory.

Monitor Directory for Changes

Look at inotify.

With inotify you can watch a directory for file creation.

Monitoring file changes in C++ on Linux

When you use inotify, you do not require to poll for all files to check if there are changes. You get a callback system that notifies you when a watched file or directory got changed.

The kernel/filesystem already has this information, so the resource/CPU usage is not just moved to another application, it is actually reduced.

Monitor file system activity with inotify provides more details why to use inotify, shows its basic usage and helps you set it up.

How to get notified if there is any changes in file system in USB device in linux or how to use recursively inotify

A USB storage device don't contain "files" in the abstract.

But it usually has some file system (often VFAT, but that could be something else; I do format USB keys with ext4 FS sometimes, and I do have a USB disk with both a VFAT and an ext4 file systems on it). That file system should be mounted for you to read or write files on it.

I want a utility which will notify me if there is any change in file system too.

Maybe you want to use inotify(7) facilities on such a mounted file system; the question then is unrelated to USB devices, it is the same for SATA disks and file systems on them; some file systems -notably remote ones like NFS- don't work well with inotify.

Notice that a USB storage could be used as a raw disk as a block device (even if it is usually not used that way). In that case, your question don't makes any sense. Also, a USB storage could have several partitions, so several file systems. You may need to determine which file system and partition you deal with.

You might want to first determine what file system is mounted from your USB storage (e.g. with proc(5), perhaps /proc/mounts...), and later to use inotify to see the changes in it.

If i will add or delete 1 GB from it ,Is there any utility to get notified ?

You add files (thru inode(7)-s) into your VFAT file systems (you can't add 1Gb without files). You could use df(1) to measure its occupation (and you might use watch(1) or crontab(5) to repeat that measure). You could also use inotify thru incron command. You could even format your USB disk with ext4 file system and use disk quota facilities on that.

You might want to read more about operating systems in general. I strongly recommend Operating Systems: Three Easy Pieces. If you are interested in C or C++ system programming on Linux, read some book on that (perhaps the old ALP, or something newer) then read intro(2) and syscalls(2).

linux script that monitors file changes within folders (like autospec does!)

After reading replies to other posts, I found a post (now gone), I created this script :-

#!/bin/bash

sha=0
previous_sha=0

update_sha()
{
    sha=`ls -lR . | sha1sum`
}

build () {
    ## Build/make commands here
    echo
    echo "--> Monitor: Monitoring filesystem... (Press enter to force a build/update)"
}

changed () {
    echo "--> Monitor: Files changed, Building..."
    build
    previous_sha=$sha
}

compare () {
    update_sha
    if [[ $sha != $previous_sha ]] ; then changed; fi
}

run () {
    while true; do

        compare

        read -s -t 1 && (
            echo "--> Monitor: Forced Update..."
            build
        )

    done
}

echo "--> Monitor: Init..."
echo "--> Monitor: Monitoring filesystem... (Press enter to force a build/update)"
run

---

Related Topics