Inotify, FAM, Gamin

From Noah.org
Jump to navigationJump to search

This briefly explains the relationships of the various filesystem event monitoring subsystems. These use event-based systems to monitor the filesystem for changes. For example, this allows a GUI to automatically update a directory listing if files are added by a background process. The alternative is that the user would have to refresh or the application would have to poll the system for changes every few seconds.

  • FAM stands for File Alteration Monitor. It is one of the oldest portable event monitors. It sends events to an application when changes are made to files or directories that an application has registered to me monitored. FAM is complicated and old -- it was last updated 5 years ago. Bad choice.
  • Gamin is newer and simpler than FAM. It tries to be compatible with FAM while not implementing many of the obscure feature. It is moderately maintained and widely available on many distros. It is portable, but the focus of development and testing is on Linux. It has BSD support and can be found in FreeBSD Ports. Decent choice
  • dnotify is ancient and crusty and should be ignored. Bad choice.
  • inotify is a replacement for `dnotify`. It's a Linux kernel module. It's fast and lightweight and should be available for every Linux distro flavor. The downside is that it is Linux-only, so no BSD or OS X portability. If portability is not your top priority then it's the best choice for Linux.

Winner: inotify

I wish Gamin were a little more polished and up to date. It would be my first choice since it is portable.

Python developers will want to look at pyinotify and Gamin Python. These are Ubuntu packages python-pyinotify (universe) and python-gamin (main). There is also a handy collection of inotify-tools available that lets you easily use inotify from a the shell and in shell scripts.

The fsniper tool is an interesting utility for watching a directory and processing various event scripts based on the filetype of a new file. It is based on inotify.

The incron tool is a utility for triggering scripts based on filesystem events. It is similar in setup to cron. It is based on inotify.

On Ubuntu you should install the inotify-tools package. This will allow you to use inotify from the command-line.

sudo aptitude install inotify-tools

monitor a directory for changes with inotify

The following example will display filenames created or destroyed in /dev. This examples shows what happens when I inserted a USB flash drive into a USB bus. Note that this only watches the top level of /dev. This example is not recursive, so it does not watch any subdirectories under /dev/. You may add the '--recursive' option to this example. When I tested with this option I was notified of 136 events just from inserting a USB flash drive.

inotifywait --monitor --event CREATE --event DELETE /dev/
Setting up watches.  
Watches established.
/dev/ CREATE usbdev1.12_ep81
/dev/ CREATE usbdev1.12_ep01
/dev/ CREATE usbdev1.12_ep00
/dev/ CREATE sg6
/dev/ CREATE .tmp-block-8:80
/dev/ DELETE .tmp-block-8:80
/dev/ CREATE sdf
/dev/ CREATE .tmp-block-8:81
/dev/ DELETE .tmp-block-8:81
/dev/ CREATE sdf1

This example will display a notify popup when a file is updated in ~/Maildir. You must have the `notify-send` command installed (on Ubuntu use `aptitude install libnotify-bin`).

inotifywait -mrq -e create -e modify -e delete -e attrib -e move ~/Maildir | while read file
do
  (notify-send "File updated in Maildir:" "$file"&)
done