I can't see why you couldn't do that. If you for instance would 'inotifywait -m -r --format '%w%f' /dev/shm' you'd have output of all file ops on stdout to do with as you please. The problem is that without "-e", if you for instance copy a file to /dev/shm, you'd see all calls (open, modify, close write, close). But without those you wouldn't notice if if you for instance copy a file to /dev/shm and immediately after that copy it *again*. So you'd prolly need to implement some "logic" to filter out stuff.
|