How to Find Out What Inotify Watches Have Been Registered

What is a reasonable amount of inotify watches with Linux?

/proc/sys/fs/inotify/max_user_watches is the current max number of watches per user.

Historically, the kernel has defaulted this to 8192, but given that many Linux distros customize their kernel builds quite a bit, this may not be true on every Linux system. A recent kernel change [1] dynamically selects a default max_user_watches value in the range [8192, 1048576] based on how much RAM the system has. (5.11 is the first kernel release containing this change.)

AFAICT, root can change max_user_watches to any value that's 2147483647 (2³¹-1) or under, as long as you're confident you have enough RAM to support that number of watches.

[1] https://github.com/torvalds/linux/commit/92890123749bafc317bbfacbe0a62ce08d78efb7

Error User limit of inotify watches reached . ExtReact build

Why?

Programs that sync files such as dropbox, git etc use inotify to notice changes to the file system. The limit can be see by -

cat /proc/sys/fs/inotify/max_user_watches

For me, it shows 100000. When this limit is not enough to monitor all files inside a directory it throws this error.

Increasing the amount of inotify watchers(Short version):

If you are running Debian, RedHat, or another similar Linux distribution, run the following in a terminal:

echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf && sudo sysctl -p

If you are running ArchLinux, run the following command instead (see here for why):

echo fs.inotify.max_user_watches=524288 | sudo tee /etc/sysctl.d/40-max-user-watches.conf && sudo sysctl --system

Then paste it in your terminal and press on enter to run it.

Technical details:

Listen uses inotify by default on Linux to monitor directories for changes. It's not uncommon to encounter a system limit on the number of files you can monitor. For example, Ubuntu Lucid's (64bit) inotify limit is set to 8192.

You can get your current inotify file watch limit by executing:

$ cat /proc/sys/fs/inotify/max_user_watches

When this limit is not enough to monitor all files inside a directory, the limit must be increased for Listen to work properly.

You can set a new limit temporary with:

$ sudo sysctl fs.inotify.max_user_watches=524288
$ sudo sysctl -p

If you like to make your limit permanent, use:

$ echo fs.inotify.max_user_watches=524288 | sudo tee -a /etc/sysctl.conf
$ sudo sysctl -p

You may also need to pay attention to the values of max_queued_events and max_user_instances if Listen keeps on complaining.

Source: https://github.com/guard/listen/wiki/Increasing-the-amount-of-inotify-watchers

How to tell which path a fanotify event refers to

You can use readlink on /proc/self/fd/<fdnum>, where fdnum refers to the fd member of the struct fanotify_event_metadata for the event.

How to stop inotify from monitoring a directory?

inotify_rm_watch is a programing interface that needs to be called from same process that called inotify_add_watch in first place.

Inotify is used by programs to react to file changes. To stop it from happening you have to stop the specific program using inotify. But in most cases you probably don't want to stop programs from watching for file changes because it is part of intended behavior for them.

You can list all programs using inotify with following shell command:

ps -p $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' -print 2> /dev/null | sed -e 's/^\/proc\/\([0-9]*\)\/.*/\1/')

inotify missing events

In the meanwhile I found that this is a known issue of inotify. If two events appear virtually at the same time, inotify only catches one of them.
My solution: I don't use inotify anymore, but took libudev instead to monitor the devices plugged to the machine...