Hi everyone,

I need to keep track of certain files on the disk. I need to know when a file is deleted, or moved for example. I'm using linux and I thought inotify could to do this job.

But the problem is: Using inotify, when I move a file, I need to have the destination folder also being watched in order to know the new location of the moved file. But these files can be moved to anywhere. So of course, it is not workable to have all directories being watched. Even when a file is renamed, I am not able to find out which is the new name of the file.

Any suggestions on how can I solve that?

Thanks in advance.

That doesn't indicate a problem with Inotify but rather a fundamental misunderstanding of How Things Work.


It could be beneficial (for you) if you post 0) the exact reasons why you need this, 1) the name of the process(es) causing this, 2) and a clear example of this. That would make it way easier to post specific solutions. For instance if this is only about unprivileged users then it would never be necessary to watch a whole filesystem as they are not able to move files to say /sbin anyway.

OK, I'm not saying this is a problem with inotify, I'm saying that apparently i cannot do what i want to do with it, and i'm asking for suggestions on alternative ways.

OK, it is not necessary to watch some dirs, like /sbin, but, anyway, the number of directories I have to watch is too big, so I want a better solution.

As I said, I need to know where a certain file is, at any point of time...

I think you fail to understand me properly. Allow me to explain as tersely as possible. Notice that at the time of posting I had approximately 16K+ posts here on LQ. At least two thirds of those I raked up by helping LQ members troubleshoot their problems (or sometimes: their questions). When members post specific, detailed, technical information then troubleshooting often becomes (more) easy. When they do not then asking questions will often provide the required information to either nudge them on, do research or propose a workaround or solution. Persistence, patience, process of elimination. Right now what you are doing is basically repeating yourself without providing any of the requested information. That leads to frustration on both sides. Frustration leads to anger and we all know what anger leads to...
So. To recap: it would be efficient and beneficial (for you) if you post
0) the exact reasons why you need this (what are you really trying to accomplish, prevent or anticipate),
1) the name of the process(es) causing this (or user(s) details),
2) and an example of this.

Hello unSpawn,

thank you for your good will on help me.

My goal is to maintain certain properties for some files. These properties are kept in another file, that references the file and its properties. (for this reason I need to know where a certain file really is, at any time).

I was searching on the internet and I'm almost sure that there is no way to do it without adding watches for all directories. I was looking at the source code of beagle (desktop indexer), and I saw it was doing this manner.

If a file is copied then it's a new file. If a file is moved to another file system, it must be copied; therefore, you must either assume that a file will stay on a single file system, or you must find another way to deal with moved files. Too much automation is a bad thing because it almost always involves hiding in the dark and making assumptions so you don't have to bother the user. Just out of curiosity, why should a moved file be considered the same file if it can't be tracked by your program already? What if a file is moved or deleted when your program isn't running?
Kevin Barry

Yes. Now (since I had these issues), among other assumptions, I'm assuming my program is always running and it is limited to a single file system.

And answering your question, the moved file, is still the same file, and for that reason should keep its properties. But I only can know that, if my program is running when the move take place.

Citing the example of beagle, it apparently adds watches for your home dir (and all subdirs). When it detects a "moved from" event, without a "moved to" event (ie. the file was moved to a unwatched dir), then it removes metadata for that file (in the same way when the file itself is removed).

If your system supports procfs, you might just open the files you're tracking and if they seem to no longer be there, check the symlink for the corresponding file in /proc/self/fd. That's assuming procfs will update the file location if it moves while it's open, which I assume it does because /proc is generated on the fly.
Kevin Barry

hmm, very clever. Thanks for this.

Yes, the symlink is updated. But I think it is only workable if the number of files is small, because I need to open all files and I think I need to add inotify watches too, at least for the directory of the file to know when to look for the procfs informations about the new path.