Monitoring file or directory changes

Monitoring file or directory changes

Many modern systems provide a way to watch a directory forevents (new files, reading the directory, modification of a file inthe directory, etc.). This facility can be done in various ways,from providing hooks in the filesystem code itself to somethingthat watches for inode changes. Linux and BSD have severalpossibilities in that regard, including dnotify ( replaced by inotify), changedfiles, watch, Gamin and fam.

Mac OS X has FileMonitor(shareware), FSEvents and it’s certainly possible that some of the BSDtools might compile on OS X. But what do you do when there is nosupport in the OS?

Brute Force

Typically you are interested in new files in a particulardirectory. You can do something like this:

touch /tmp/testdirb.$$while truedols /testdir > /tmp/testdira.$$diff /tmp/testdira.$$ /tmp/testdirb.$$ || echo "changed"cp /tmp/testdira.$$ /tmp/testdirb.$$sleep 300done

If you were looking for a particular file to change, you’d use”ls -l”, and if your interest was in if the file was being used orexecuted, “ls -lut” would give you that. This example justs echoeswhen something changes, but you would more likely call some otherscript that did more testing. One obvious issue that comes up if afile has been created is waiting for the creating program to havefinished up: lsof or fuser can help you with that.

But this is all pretty crude. Sometimes crude is fine, but ifyou need to know more often, there’s a fair amount of overhead inthis that you really don’t need.

If it is just one file, and your interest is additions to it,the mailchecking utility in your shell can give you alerts. Forexample, in Linux bash:


You can watch multiple files, each with its own message, byusing MAILPATH instead of MAIL. You need to “unset MAIL”, and setand export MAILPATH:

unset MAILMAILPATH='/tmp/foo/h?"H is changed":/tmp/foo/a?"A has changed"'export MAILPATH


Linux systems have a command line “stat” that can make checkingchanges a little less intensive. “stat -t testdir” looks somethinglike this:

testdir 4096 8 41ed 5001 5001 303 82022 2 2b 1d 1070127877 1070128608 1070128608

which is everything you want to know about the file or directoryfor this purpose. SecurityEnhanced Linux versions add another field which we need tostrip out for our purposes here:

OLD=`stat -t testdir`# OLD=`stat -t testdir | sed 's/[0-9][0-9]*$//'`  # if SE linux statwhile truedoNEW=`stat -t testdir`# NEW=`stat -t testdir | sed 's/[0-9][0-9]*$//'`  if SE linux stat[ "$NEW" == "$OLD" ] || echo "changed!"sleep 3done

You could get fancier by splitting out the fields into separatevariables. That isn’t a lot of fun at the shell level, so we’llmove up a notch.

Perl or C

From Perl or C (and of course many other languages), you can getaccess to the stat information a bit more easily. Here’s a simplePerl example like those already given:

#!/usr/bin/perl@info=stat("testdir") or die "Can't stat testdir $!";while (1) {@newinfo=stat("testdir") or die "Can't stat testdir $!";@what=qw(Device Inum Mode Links Owner Group Rdev Size Atime Mtime Ctime PBlock Blocks);$x=0;while ($info[$x]) {  system("/bin/echo $what[$x] $info[$x] $newinfo[$x]") if ($info[$x] ne $newinfo[$x]);  $x++;}@info=@newinfo;sleep 1;}

If this page was useful to you, please click to help others find it:  
Your +1’s can help friends, contacts, and others on the web find the best stuff when they search.


More Articles by

Click here to add your comments

—November 23, 2004

—December 1, 2004

—January 4, 2005

The while loop fails to detect a change if one of the values of $info is 0. The while loop should be something liket this so that the whole array is checked:

while (scalar(@info) > $x) { }

—January 11, 2005


Wed Feb 24 06:54:22 2010:   noan

may i copied and linked your article to my blog?

Wed Feb 24 11:50:32 2010:   TonyLawrence

Yes – if it is correctly attributed back here, you may. Please let me know where you have put it.

Thu Feb 25 01:14:43 2010:   Rizki
This is the link to my blog that copied your article

Thu Feb 25 01:20:12 2010:   TonyLawrence


Thu Feb 25 01:24:31 2010:   TonyLawrence

I’m sorry, though: you didn’t do it quite right.


It needs to say that my post is Copyright Anthony Lawrence at

Other than that, it’s fine.

Don’t miss responses! Subscribe to Comments by RSS or by Email

Click here to add your comments

If you want a picture to show with your comment, go get a Gravatar

LOD Communications, Inc.

Have you tried Searching this site?

Unix/Linux/Mac OS X support by phone, email or on-site:Support Rates

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to’s, tutorials and more. We appreciate comments and article submissions.

Publishing your articles here

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That’s mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.

This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s