I want to watch a file created and written in a directory by a process. I don't have access to inotifywait tool, so I'm using just the inotify library calls. I start with IN_CREATE to monitor that the file was created. If the file of interest was created, then I drop in a CLOSE_WRITE event to be monitored. This scheme kind of works, except in the case that the file was already written and closed to by the time my handler processes the IN_CREATE event, and I miss that write event.
What is the best way to work around this situation? I was considering using the stat function to use atim, mtim, but wasn't sure if that would have any gotchas. For example, I was planning to check if the current timestamp is greater than st_ctim, and if st_ctim is greater than st_atim. These two conditions would indicate that the file status changed (accessed and changed) before the current time.