inotifywait

Watch a specific file for events, exiting after the first one

$ inotifywait [path/to/file]

$ inotifywait [[-m|--monitor]] [path/to/file]

$ inotifywait [[-m|--monitor]] [[-r|--recursive]] [path/to/directory]

$ inotifywait [[-m|--monitor]] [[-r|--recursive]] --exclude "[regex]" [path/to/directory]

$ inotifywait [[-m|--monitor]] [[-t|--timeout]] [30] [path/to/file]

$ inotifywait [[-e|--event]] [modify] [path/to/file]

$ inotifywait [[-q|--quiet]] [path/to/file]

$ inotifywait [[-e|--event]] [access] [path/to/file] && [command]

inotifywait [options] file|dir [...]

-m, --monitor
    Continuously monitor for events; don't exit after the first event occurs.

-r, --recursive
    Monitor directories recursively. Events are reported for files and directories inside the monitored path, as well as the path itself.

-q, --quiet
    Output less information, primarily for scripting. Does not output event details but reports errors.

-e event, --event event
    Specify event(s) to watch for. If omitted, all events are monitored. Multiple events can be specified using multiple -e options. Examples include create, modify, delete, access, open, close_write, moved_from, moved_to.

-t seconds, --timeout seconds
    Exit after specified time if no events occur. A timeout of 0 will cause inotifywait to exit immediately if no events are pending.

--format format_string
    Specify the output format for events using printf-like format specifiers (e.g., %w for watched path, %f for filename, %e for events).

--timefmt format_string
    Specify the time format for the %T format specifier when using --format. Uses strftime(3) syntax.

-o file, --outfile file
    Print events to a specified file instead of standard output.

--fromfile file
    Read paths to watch from a file, one path per line. Useful for watching many paths simultaneously.

inotifywait is a command-line utility from the inotify-tools package that provides a convenient interface to the Linux kernel's inotify API. It effectively allows a script or user to wait for and respond to specific filesystem events occurring on designated files or directories. When executed, inotifywait blocks until one of the specified events (such as creation, modification, deletion, or movement of files) happens.

This real-time monitoring capability makes it invaluable for various automated tasks, including triggering backups when files are saved, synchronizing content across different locations upon changes, or analyzing log files as new entries are written. It can monitor multiple paths simultaneously and provides options to filter events by type, output information in a custom format, and operate in a recursive or continuous monitoring mode. By leveraging the efficient inotify kernel subsystem, inotifywait offers a performant way to react to filesystem changes without constant polling.

inotifywait does not report events from network filesystems (e.g., NFS, SMB, AFS) as the underlying inotify kernel API only monitors local filesystems.

There are kernel limits on the number of watches that can be active simultaneously, which might be hit when recursively monitoring very large directory trees.

Recursive monitoring (-r) on extremely large or busy directory structures can be resource-intensive and potentially impact system performance.

inotifywait is frequently used for scripting automated tasks such as: triggering website deployments when source files change, initiating backups or synchronization scripts upon file modifications, monitoring log files for specific patterns as new entries are added, and auditing file access or changes for security purposes.

Some of the most commonly monitored event types include: create (file/directory created), modify (file content modified), delete (file/directory deleted), access (file read), open (file opened), close_write (file closed after being opened for writing), moved_from (file/directory moved from), and moved_to (file/directory moved to).

The inotify API, which inotifywait leverages, was introduced into the Linux kernel in version 2.6.13 (2005). The inotify-tools package, including inotifywait and inotifywatch, was subsequently developed to provide convenient user-space utilities for interacting with this new kernel feature, making filesystem event monitoring accessible for scripting and automation.

inotify(7), inotifywatch(1), watch(1), tail(1)