Monitoring file or directory changes

Many modern systems provide a way to watch a directory for events (new files, reading the directory, modification of a file in the directory, etc.). This facility can be done in various ways, from providing hooks in the filesystem code itself to something that watches for inode changes. Linux and BSD have several possibilities in that regard, including dnotify, changedfiles, watch, and fam.

Mac OS X has FileMonitor (shareware), and it's certainly possible that some of the BSD tools might compile on OS X. But what do you do when there is no support in the OS?

Brute Force

Typically you are interested in new files in a particular directory. You can do something like this:

touch /tmp/testdirb.$$
while true
do
ls /testdir > /tmp/testdira.$$
diff /tmp/testdira.$$ /tmp/testdirb.$$ || echo "changed"
cp /tmp/testdira.$$ /tmp/testdirb.$$
sleep 300
done
 

If you were looking for a particular file to change, you'd use "ls -l", and if your interest was in if the file was being used or executed, "ls -lut" would give you that. This example justs echoes when something changes, but you would more likely call some other script that did more testing. One obvious issue that comes up if a file has been created is waiting for the creating program to have finished up: lsof or fuser can help you with that.

But this is all pretty crude. Sometimes crude is fine, but if you need to know more often, there's a fair amount of overhead in this that you really don't need.

If it is just one file, and your interest is additions to it, the mailchecking utility in your shell can give you alerts. For example, in Linux bash:

MAIL=/tmp/watchthis
MAILCHECK=10
 

You can watch multiple files, each with its own message, by using MAILPATH instead of MAIL. You need to "unset MAIL", and set and export MAILPATH:

unset MAIL
MAILPATH='/tmp/foo/h?"H is changed":/tmp/foo/a?"A has changed"'
export MAILPATH
 

Stat

Linux systems have a command line "stat" that can make checking changes a little less intensive. "stat -t testdir" looks something like this:

testdir 4096 8 41ed 5001 5001 303 82022 2 2b 1d 1070127877 1070128608 1070128608
 

which is everything you want to know about the file or directory for this purpose. Security Enhanced Linux versions add another field which we need to strip out for our purposes here:

OLD=`stat -t testdir`
# OLD=`stat -t testdir | sed 's/[0-9][0-9]*$//'`  # if SE linux stat
while true
do
NEW=`stat -t testdir`
# NEW=`stat -t testdir | sed 's/[0-9][0-9]*$//'`  if SE linux stat
[ "$NEW" == "$OLD" ] || echo "changed!"
sleep 3
done
 

You could get fancier by splitting out the fields into separate variables. That isn't a lot of fun at the shell level, so we'll move up a notch.

Perl or C

From Perl or C (and of course many other languages), you can get access to the stat information a bit more easily. Here's a simple Perl example like those already given:

#!/usr/bin/perl
@info=stat("testdir") or die "Can't stat testdir $!";
while (1) {
@newinfo=stat("testdir") or die "Can't stat testdir $!";
@what=qw(Device Inum Mode Links Owner Group Rdev Size Atime Mtime Ctime PBlock Blocks);
$x=0;
while ($info[$x]) {
  system("/bin/echo $what[$x] $info[$x] $newinfo[$x]") if ($info[$x] ne $newinfo[$x]);
  $x++;
}
@info=@newinfo;
sleep 1;
}
 

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.