inotify(7) Miscellaneous Information Manual inotify(7) inotify - inotify . inotify . inotify . : o inotify_init(2) inotify inotify. inotify_init1(2) inotify_init(2) flags . o inotify_add_watch(2) inotify. ("") . inotify_add_watch(2) . " " inotify_add_watch(2) . o inotify read(2) ( ). o inotify_rm_watch(2) inotify. o inotify ( close(2)) . inotify . . . inotify read(2) inotify. read(2) ( EINTR signal(7)). read(2) : struct inotify_event { int wd; /* Watch descriptor */ uint32_t mask; /* Mask describing event */ uint32_t cookie; /* Unique cookie associating related events (for rename(2)) */ uint32_t len; /* Size of name field */ char name[]; /* Optional null-terminated name */ }; wd . inotify_add_watch(2). mask ( ). cookie . IN_MOVED_FROM IN_MOVED_TO. cookie 0. name . ('\0') . len name inotify_event sizeof(struct inotify_event)+size. read(2) : Linux 2.6.21 read(2) 0 Linux 2.6.21 read(2) EINVAL. sizeof(struct inotify_event) + NAME_MAX + 1 . inotify mask inotify_add_watch(2) mask inotify_event read(2) inotify inotify. mask inotify_add_watch(2) mask read(2): IN_ACCESS (+) ( read(2) execve(2)). IN_ATTRIB (*) -- ( chmod(2)) ( utimensat(2)) (setxattr(2)) ( Linux 2.6.25 link(2) unlink(2)) / ( chown(2)). IN_CLOSE_WRITE (+) . IN_CLOSE_NOWRITE (*) . IN_CREATE (+) / ( open(2) O_CREAT mkdir(2) link(2) symlink(2) bind(2) UNIX). IN_DELETE (+) / . IN_DELETE_SELF / . ( mv(1) .) IN_IGNORED . IN_MODIFY (+) ( write(2) truncate(2)). IN_MOVE_SELF / . IN_MOVED_FROM (+) . IN_MOVED_TO (+) . IN_OPEN (*) . Inotify inode: ( ) ( ). : o (*) o (+) ( ). : ( ) . name inotify_event . IN_ALL_EVENTS . mask inotify_add_watch(2). : IN_MOVE IN_MOVED_FROM | IN_MOVED_TO. IN_CLOSE IN_CLOSE_WRITE | IN_CLOSE_NOWRITE. mask inotify_add_watch(2): IN_DONT_FOLLOW ( Linux 2.6.15) pathname . IN_EXCL_UNLINK ( Linux 2.6.36) . ( /tmp ). IN_EXCL_UNLINK . IN_MASK_ADD pathname (OR) mask ( ) EINVAL IN_MASK_CREATE . IN_ONESHOT pathname . IN_ONLYDIR ( Linux 2.6.15) pathname ENOTDIR pathname . . IN_MASK_CREATE ( Linux 4.18) pathname EEXIST pathname . . inode inotify_add_watch(2) . mask read(2): IN_IGNORED (inotify_rm_watch(2)) ( ). BUGS. IN_ISDIR . IN_Q_OVERFLOW (wd -1 ). IN_UNMOUNT . IN_IGNORED . dir dir/myfile . . fd = open("dir/myfile", O_RDWR); IN_OPEN dir dir/myfile. read(fd, buf, count); IN_ACCESS dir dir/myfile. write(fd, buf, count); IN_MODIFY dir dir/myfile. fchmod(fd, mode); IN_ATTRIB dir dir/myfile. close(fd); IN_CLOSE_WRITE dir dir/myfile. dir1 dir2 dir1/myfile. . link("dir1/myfile", "dir2/new"); IN_ATTRIB myfile IN_CREATE dir2. rename("dir1/myfile", "dir2/myfile"); IN_MOVED_FROM dir1 IN_MOVED_TO dir2 IN_MOVE_SELF myfile. IN_MOVED_FROM IN_MOVED_TO cookie. dir1/xx dir2/yy ( ) dir1 dir2 dir1/xx dir2/yy. : unlink("dir2/yy"); IN_ATTRIB xx ( ) IN_DELETE dir2. unlink("dir1/xx"); IN_ATTRIB IN_DELETE_SELF IN_IGNORED xx IN_DELETE dir1. dir () dir/subdir. . mkdir("dir/new", mode); IN_CREATE | IN_ISDIR dir. rmdir("dir/subdir"); IN_DELETE_SELF IN_IGNORED subdir IN_DELETE | IN_ISDIR dir. /proc inotify: /proc/sys/fs/inotify/max_queued_events inotify_init(2) inotify. IN_Q_OVERFLOW . /proc/sys/fs/inotify/max_user_instances inotify . /proc/sys/fs/inotify/max_user_watches . . Inotify Linux 2.6.13. glibc 2.4. (IN_DONT_FOLLOW IN_MASK_ADD IN_ONLYDIR glibc 2.5.) inotify select(2) poll(2) epoll(7). . Linux 2.6.25 / inotify F_SETFL ( O_ASYNC) F_SETOWN F_SETSIG fcntl(2). siginfo_t ( sigaction(2)) : si_fd inotify si_signo si_code POLL_IN POLLIN si_band. inotify inotify ( wd mask cookie name) ( BUGS). inotify . inotify . inotify. inotify inotify /proc/pid/fdinfo. proc(5) . FIONREAD ioctl(2) inotify. inotify inotify. inotify . Inotify . . ( .) /proc /sys /dev/pts inotify. inotify mmap(2) msync(2) munmap(2). inotify . inotify . inotify . ( ) . . inotify : . . ( ) . ( ). . . . . ( inotify inotify .) . . rename() IN_MOVED_FROM IN_MOVED_TO rename(2) . . inotify. . ( ) IN_MOVED_FROM IN_MOVED_TO. : IN_MOVED_FROM IN_MOVED_TO . IN_MOVED_FROM IN_MOVED_TO rename(2) . ( IN_MOVED_TO.) ( ) IN_MOVED_FROM IN_MOVED_TO . . ( inotify .) IN_MOVED_FROM read(2) IN_MOVED_TO read(2) () IN_MOVED_FROM+IN_MOVED_TO IN_MOVED_TO. 3.19 fallocate(2) inotify. 3.19 fallocate(2) IN_MODIFY. 2.6.16 IN_ONESHOT mask. IN_ONESHOT IN_IGNORED . 2.6.36 IN_IGNORED . 2.6.25 ( ) . inotify_rm_watch(2) ( ) . inotify_add_watch(2) ( 1 INT_MAX) . inotify. . INT_MAX . 3.15 . inotify. IN_OPEN IN_CLOSE_NOWRITE IN_CLOSE_WRITE. /home/user/temp/foo /tmp. IN_OPEN. IN_CLOSE_WRITE. IN_CLOSE_NOWRITE. ENTER. $ ./a.out /tmp /home/user/temp; Press enter key to terminate. Listening for events. IN_OPEN: /home/user/temp/foo [file] IN_CLOSE_WRITE: /home/user/temp/foo [file] IN_OPEN: /tmp/ [directory] IN_CLOSE_NOWRITE: /tmp/ [directory] Listening for events stopped. #include #include #include #include #include #include #include /* Read all available inotify events from the file descriptor 'fd'. wd is the table of watch descriptors for the directories in argv. argc is the size of wd and argv. argv is the list of watched directories. Entry 0 of wd and argv is unused. */ static void handle_events(int fd, int *wd, int argc, char* argv[]) { /* Some systems cannot read integer variables if they are not properly aligned. On other systems, incorrect alignment may decrease performance. Hence, the buffer used for reading from the inotify file descriptor should have the same alignment as struct inotify_event. */ char buf[4096] __attribute__ ((aligned(__alignof__(struct inotify_event)))); const struct inotify_event *event; ssize_t size; /* Loop while events can be read from inotify file descriptor. */ for (;;) { /* Read some events. */ size = read(fd, buf, sizeof(buf)); if (size == -1 && errno != EAGAIN) { perror("read"); exit(EXIT_FAILURE); } /* If the nonblocking read() found no events to read, then it returns -1 with errno set to EAGAIN. In that case, we exit the loop. */ if (size <= 0) break; /* Loop over all events in the buffer. */ for (char *ptr = buf; ptr < buf + size; ptr += sizeof(struct inotify_event) + event->len) { event = (const struct inotify_event *) ptr; /* Print event type. */ if (event->mask & IN_OPEN) printf("IN_OPEN: "); if (event->mask & IN_CLOSE_NOWRITE) printf("IN_CLOSE_NOWRITE: "); if (event->mask & IN_CLOSE_WRITE) printf("IN_CLOSE_WRITE: "); /* Print the name of the watched directory. */ for (size_t i = 1; i < argc; ++i) { if (wd[i] == event->wd) { printf("%s/", argv[i]); break; } } /* Print the name of the file. */ if (event->len) printf("%s", event->name); /* Print type of filesystem object. */ if (event->mask & IN_ISDIR) printf(" [directory]\n"); else printf(" [file]\n"); } } } int main(int argc, char* argv[]) { char buf; int fd, i, poll_num; int *wd; nfds_t nfds; struct pollfd fds[2]; if (argc < 2) { printf("Usage: %s PATH [PATH ...]\n", argv[0]); exit(EXIT_FAILURE); } printf("Press ENTER key to terminate.\n"); /* Create the file descriptor for accessing the inotify API. */ fd = inotify_init1(IN_NONBLOCK); if (fd == -1) { perror("inotify_init1"); exit(EXIT_FAILURE); } /* Allocate memory for watch descriptors. */ wd = calloc(argc, sizeof(int)); if (wd == NULL) { perror("calloc"); exit(EXIT_FAILURE); } /* Mark directories for events - file was opened - file was closed */ for (i = 1; i < argc; i++) { wd[i] = inotify_add_watch(fd, argv[i], IN_OPEN | IN_CLOSE); if (wd[i] == -1) { fprintf(stderr, "Cannot watch '%s': %s\n", argv[i], strerror(errno)); exit(EXIT_FAILURE); } } /* Prepare for polling. */ nfds = 2; fds[0].fd = STDIN_FILENO; /* Console input */ fds[0].events = POLLIN; fds[1].fd = fd; /* Inotify input */ fds[1].events = POLLIN; /* Wait for events and/or terminal input. */ printf("Listening for events.\n"); for (;;) { poll_num = poll(fds, nfds, -1); if (poll_num == -1) { if (errno == EINTR) continue; perror("poll"); exit(EXIT_FAILURE); } if (poll_num > 0) { if (fds[0].revents & POLLIN) { /* Console input is available. Empty stdin and quit. */ while (read(STDIN_FILENO, &buf, 1) > 0 && buf != '\n') continue; break; } if (fds[1].revents & POLLIN) { /* Inotify events are available. */ handle_events(fd, wd, argc, argv); } } } printf("Listening for events stopped.\n"); /* Close inotify file descriptor. */ close(fd); free(wd); exit(EXIT_SUCCESS); } inotifywait(1), inotifywatch(1), inotify_add_watch(2), inotify_init(2), inotify_init1(2), inotify_rm_watch(2), read(2), stat(2), fanotify(7) Documentation/filesystems/inotify.rst 3 . . : . 6.18 14 2026 inotify(7)