Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • 1
    .bashrc in the example @ serverfault does not appear in the stats because the user monitors its home directory recursively but because path/.* is expanded and as a result a watch is set for all the .files under path/ (.bashrc included). The command used by the OP will never output file names because the watches are set for /tmp and any subdirectories therefore statistics will pertain only to /tmp and its subdirectories (i.e. you will see files have been accessed/moved/etc but it won't tell you their names). Commented Oct 29, 2014 at 13:39
  • @don_crissti Oops, I mixed up the two examples given by the OP. I edited my answer, thanks! Commented Oct 29, 2014 at 13:49
  • Thanks, it was useful. Here is my command to show content of all newly created test* files in /tmp: inotifywait -m --format "%f" /tmp | grep --line-buffered ^test | xargs -L1 -I% sudo cat /tmp/% 2> /dev/null. Commented Oct 29, 2014 at 14:00
  • Also: "It means that any event which occurs on a file created after the watches have been placed will not be detected." Any event (even the file creation) WILL be detected because a watch is ALREADY set for the containing directory and this is reflected in the statistics for that particular directory. See inotifywatch output in the OP question: the 2 create events are there (so they are detected) but since inotifywatch watches a directory (+any subdirectories) the statistics pertain only to that/those directories. Commented Oct 29, 2014 at 15:19
  • 1
    I don't think we're on the same wavelength here... man inotify: When a directory is monitored, inotify will return events for the directory itself, and for files inside the directory. Also, man inotifywatch is clear about which events are being watched: > EVENTS > ... A watched file or a file within a watched directory was accessed/closed/open/etc (means including events "which occur on a file"). Events for a file created after setting the watch on parent dir WILL be detected & reflected in inotifywatch stats (it will NOT mention for which files those events occured). Commented Oct 29, 2014 at 20:35