I need to monitor various directories contained in one base directory, and notify certain users by email when a file has been added or changed in their monitored directory. I wrote a script using inotifywait, and when an event is triggered it fires of an email to the user with the location & the new file name.

The script is working, but can generate many emails for one event (saving a large file for example).

I have tried many of the different --event types available in inotifywait to see if I could get it down to one notification. No luck yet. Here is the basic outline of the script. Any thoughts on how I might be able to get this to only send one email per file would be greatly appreciated.

#!/bin/bash
#
# usage: script DIR email-to-addr

DIR=$1
EMAILTO=$2

inotifywait --recursive --monitor --quiet --exclude '.*\.tmp' \
--event close_write --format '%f' \
/var/www/htdocs/contracts/contracts/$DIR | while read FILE ;
do
{
echo "To: $EMAILTO"
echo "From: MONITOR ROBOT <DO-NOT-REPLY@somewhere.com>"
echo "Subject: Alert - $DIR"
echo " "
echo "A new file has been detected in $DIR"
echo ""
echo "The New File is named:"
echo " "
echo $FILE
} 2>&1 | /usr/bin/sendmail -t
done

Thanks!

Mr. B-o-B

Yes, inotifywait can seem to be noisy, but in reality there are no spurious notifications.

You are only watching close_write notifications, so you are not seeing all the others that can accompany it.

You appear to be using it in a web server environment, so it might be worthwhile to consider how the files are being written, i.e. php or other web scripting process. Are those generating open/close events differently than using an editor maybe? Or if using an editor, is there an auto-save function that updates the file every once in a while when it is open?

If the files are actually being only uploaded or submitted via web form, you might try using the create event instead - it really is singular.

My own experience with inotifywait has been that when I get a torrent of events when I don't think I should, carefully setting up a few test cases and capturing them for analysis helps much!

OK - last and most difficult - I have had a particular case, much like yours, where some events simply cascade for whatever reason, but still need to be treated as a single event. To handle those I set up a queue consisting of an array where the filename is the hash. So duplicate entries to the queue are a single entry. I then run a second process that handles the queued entries after they are a certain age (30 seconds in my case). But that was more difficult than it sounds because then you have the inotifywait loop, and ... how do you run the queue? It became a much more complex application in my case.

An easier way for you might be to write the events to a file and run a cron job that reads that file every few minutes and detects the duplicates then sends the emails.

Good luck!

Mr. B-o-b,

I came across this post while looking for a similar solution. I've written an emailer back-end for our FTP server. It relies heavily on shell scripting to tell when files are transferred. For files being put on the FTP server by local users(Drag & Dropped to a samba share from windows boxes), it looks for locked files via smbstatus -L. For files downloaded by vendors another script polls FTP connections with netstat -A inet -tn | grep $localip:21. Cloogy at best, but it does work. We have over 700 users, of which over 300 users are active in any given 90 day period.

I've been looking at inotify-tools for a while but was stuck with the same problem too many notifications. I've since discovered that it may not work for me. With 700 directories, each having 2 subdirectories, I get a LOT of Q_OVERFLOW errors. However, Your script gave me an idea. I have only been messing with it for a few minutes, but you could use something like this for testing.

The grep -v "ISDIR" will eliminate directory listing notifications. I'm using egrep only to facilitate adding more events to exclude. In order to eliminate more events simply change the line to something like this This will filter both out. You can fine tune between the events your looking for and the grep statement to get the best output. Depending on what's left you can create if or case statements that can act on the event(s). Then if the criteria is met, send the email. This should greatly reduce the number of emails sent.

Hope it helps.

Addendum: How are files being transferred back and forth from your system? There are other push type methods of tracking file transfers other than inotify.