Inotifywait: Monitor Live Events on Files and Directories on Linux

Inotifywait is a Linux command-line utility that assists system administrators in monitoring events such as opening, modifying, reading, closing, moving, or deleting on files or directories.

It can seamlessly integrate with other tools or be used within a shell script. So, if you want to receive notifications when any event occurs on a file or directory, you can use it for that.

In this article, I’ll demonstrate how to install inotifywait on your preferred Linux distribution, detect file or directory changes, and use it in a shell script with a practical example.

Tutorial Details

How to Install Inotifywait on Linux

inotifywait is available in the majority of Linux repositories as part of the “inotify-tools” package, which can be conveniently installed using the default package manager of the Linux distribution.

# On Debian, Ubuntu, Mint, Pop!_OS, etc.
$ sudo apt install inotify-tools

# On Redhat, Fedora, AlmaLinux, etc.
$ sudo dnf install epel-release
$ sudo dnf install inotify-tools

# On Arch, Manjaro, EndeavourOS, etc.
$ sudo pacman -S inotify-tools

Once the installation is complete, the “inotifywait” command will become accessible.

Usage of Inotifywait

To showcase its use case, we’ll see various examples, starting with its syntax, followed by monitoring file and directory content, and then how to use it in a shell script. So, let’s begin with…

Inotifywait Syntax and Flags

The “inotifywait” command takes two arguments: one is the flag (optional), and the other is the path of the file or directory to monitor (required).

$ inotifywait <flag> <path/to/file>|<path/to/directory>

Check out the following useful flags:

Monitor the Events on File and Directory Using Inotifywait

When you start monitoring a file using inotifywait, you’ll be informed of when a process opens, modifies, reads, closes, moves, or deletes the file. Monitoring the directory also reveals events in any files within it.

The following is a tree hierarchy of a directory containing several files and subdirectories.

We will use this directory tree for various examples to demonstrate inotifywait usage.

So, to monitor all events occurring in our directory tree, whether triggered by us or any process, we use the “inotifywait” command with the “-r” flag for recursive monitoring of the directory and its contents. Additionally, we must include the “-m” flag to continuously monitor events until manually interrupted by the user.

$ inotifywait -r -m mydir/

Output:

Now that we’ve begun monitoring the directory’s content, it will wait for an event to happen. To demonstrate, let’s open a new terminal window and create a new file within “mydir/dir2” using the “echo "Linux TLDR" > mydir/dir2/file1” command. Once the file is created, return back to the shell where we ran inotifywait to see its output.

You can see that every event that occurred in the directory while creating the file is listed, and the output is organized into three columns: the base directory, the event, and the file that triggered the event.

Now let’s list the contents of “mydir/dir2“, access the newly created file, and then create a new directory using the following command:

$ ls mydir/dir2
$ cat mydir/dir2/file1
$ mkdir mydir/dir2/mydir1

Now let’s return to our shell with the inotifywait running:

As you can see, inotifywait carefully monitors every event in the directory. Additionally, if you want to monitor specific events like creation or deletion, you can specify these events with the “-e” flag. For example, the following command will only monitor for create and delete events.

$ inotifywait -r -m -e create,delete mydir/

Output:

To exclude specific subdirectories from monitoring, use the “--exclude” flag followed by the directory name. For example, the following command will not monitor any content from “mydir/dir1” while monitoring create and delete events for all other subdirectories.

$ inotifywait -r -m -e create,delete --exclude 'dir1/' mydir/

Output:

Finally, keep in mind that when monitoring a single file using inotifywait, the file must be present in the specified directory at the time of command initialization. Additionally, if the user removes the file, event monitoring will cease, even if the file is later recreated.

To demonstrate, I’ll monitor an existing “file1“, reading its contents, then deleting the file and attempting to read its contents again, to see if events are detected.

$ inotifywait -r -m mydir/dir1/file1

Output:

As you can clearly see, after deleting the file, even if you recreate it, the events on the file won’t be monitored because specifying the file in inotifywait attaches its inode to the command, and deleting and recreating it changes the inode of the file.

So, to monitor such a file, you can monitor the parent directory and apply a specific regular expression to check only that particular file in the directory.

Get Desktop Notification When Events Occur Using a Shell Script

I’ll now show you how to use inotifywait in your shell script for monitoring file and directory changes, and receiving immediate desktop notifications.

First, create a file named “script.sh” using your preferred text editor, either Vim or Nano, and then include the following Shebang to specify Bash shell.

#!/bin/bash

Then we will create a function that will display a desktop notification.

# Function to display desktop notification
notify() {
    notify-send "File Change" "$1"
}

Finally, we’ll execute a while loop to continuously monitor changes, specifying the “inotifywait” command to detect creation and deletion events within “mydir/“, and alerting us with desktop notifications when an event occurs.

# Monitor "mydir/" directory for create and delete events
while true; do
    inotifywait -r -q -e create,delete mydir/ && notify "A file was created or deleted in mydir/"
done

Once you insert all the aforementioned lines into the “script.sh” file, it will look like the one below:

You can now save and close the file, and then assign executable permission to it using the chmod command.

$ chmod +x ./script.sh

Once done, run the shell script, and when a create or delete event occurs in “mydir/“, it will be notified as a desktop notification.

• How to Run (.sh) Shell Script in Linux

$ ./script.sh

Output:

Final Word

This article has come to an end. I hope you find this article helpful, and as you can see, this tool can be very useful for tracking file and directory changes. Even if you’ve setup file synchronization between two devices, you can still monitor changes with this command.

Now, if you have any questions or queries related to the topic, do let me know in the comment section.

Till then, peace!