inotifywait

Watch a specific file for events, exiting after the first one

$ inotifywait [path/to/file]

$ inotifywait --monitor [path/to/file]

$ inotifywait --monitor --recursive [path/to/directory]

$ inotifywait --monitor --recursive --exclude "[regular_expression]" [path/to/directory]

$ inotifywait --monitor --timeout [30] [path/to/file]

$ inotifywait --event [modify] [path/to/file]

$ inotifywait --quiet [path/to/file]

$ inotifywait --event [access] [path/to/file] && [command]

inotifywait [options] [file2] [...]

-m, --monitor
    Keep listening for events forever.

-r, --recursive
    Watch all subdirectories of any directories passed as arguments.

-q, --quiet
    Print less output. Useful with --monitor to only get event names.

-qq, --quiet
    Print nothing except events (useful for syslog). This option overrides -q.

-d, --daemon
    Run in background as a daemon.

-o , --outfile
    Output events to instead of stdout.

-s, --syslog
    Output to syslog, instead of stdout.

-e , --event
    Listen for specific event(s) only. Multiple events can be specified with multiple -e options or with a comma separated list.

-t , --timeout
    Exit after seconds of inactivity.

-n, --no-recursion
    Disable recursion after adding the watches.

-Q, --queue-len
    Set the event queue size.

--format
    Print using a specified format.

--timefmt
    strftime-compatible format for timestamps.

-c, --csv
    Output in CSV format.

-v, --verbose
    Increase verbosity.

-h, --help
    Show help message.

-v, --version
    Show version information.

The inotifywait command is a simple utility that uses Linux's inotify subsystem to monitor a filesystem directory or file for specific events. It waits and blocks until an event occurs, reporting the events it is watching for. This makes it ideal for scripting automation tasks where you need to react to filesystem changes.

It can monitor a single file or directory, or recursively monitor a directory tree. inotifywait can be used to detect file creation, modification, deletion, attribute changes, move, and access events. Output formats can be controlled to facilitate parsing in scripts.

The tool provides a reliable way to trigger actions based on filesystem changes, replacing polling scripts with a more efficient event-driven approach. This makes inotifywait a valuable tool for developers and system administrators alike.

The inotify event queue can overflow if events are generated faster than inotifywait can process them. This can lead to missed events.

The -e option allows you to filter for specific events. Some common events include:

• ACCESS: File was accessed (read).
• MODIFY: File was modified.
• ATTRIB: Metadata changed (permissions, timestamps, etc.).
• CLOSE_WRITE: File opened for writing was closed.
• CLOSE_NOWRITE: File not opened for writing was closed.
• OPEN: File was opened.
• CREATE: File/directory created in watched directory.
• DELETE: File/directory deleted from watched directory.
• MOVE_SELF: Watched file/directory was itself moved.
• MOVED_FROM: File moved out of watched directory.
• MOVED_TO: File moved into watched directory.

• 0: The program executed successfully and all requested events were received.
• 1: An error occurred.
• 2: The -t timeout option was used and no events occurred in the specified time.

inotifywait is part of the inotify-tools package. The package was developed to provide command-line tools for utilizing the Linux inotify subsystem, which was introduced in Linux kernel 2.6.13. The tool fills the need for a simple way to react to events which happen in the file system without having to constantly poll the status of the file system.

inotifywatch(1)