Inotifywait: Monitor Live Events on Files and Directories on Linux

Linux TLDR
Last Updated:
Reading time: 5 minutes

Inotifywait is a Linux command-line utility that assists system administrators in monitoring events such as opening, modifying, reading, closing, moving, or deleting on files or directories.

It can seamlessly integrate with other tools or be used within a shell script. So, if you want to receive notifications when any event occurs on a file or directory, you can use it for that.

In this article, I’ll demonstrate how to install inotifywait on your preferred Linux distribution, detect file or directory changes, and use it in a shell script with a practical example.

Tutorial Details

DescriptionInotifywait
Difficulty LevelLow
Root or Sudo PrivilegesNo
OS CompatibilityUbuntu, Manjaro, Fedora, etc.
Prerequisites–
Internet RequiredYes (for installation)

How to Install Inotifywait on Linux

inotifywait is available in the majority of Linux repositories as part of the β€œinotify-tools” package, which can be conveniently installed using the default package manager of the Linux distribution.

# On Debian, Ubuntu, Mint, Pop!_OS, etc.
$ sudo apt install inotify-tools

# On Redhat, Fedora, AlmaLinux, etc.
$ sudo dnf install epel-release
$ sudo dnf install inotify-tools

# On Arch, Manjaro, EndeavourOS, etc.
$ sudo pacman -S inotify-tools

Once the installation is complete, the β€œinotifywait” command will become accessible.

Usage of Inotifywait

To showcase its use case, we’ll see various examples, starting with its syntax, followed by monitoring file and directory content, and then how to use it in a shell script. So, let’s begin with…

Inotifywait Syntax and Flags

The β€œinotifywait” command takes two arguments: one is the flag (optional), and the other is the path of the file or directory to monitor (required).

$ inotifywait <flag> <path/to/file>|<path/to/directory>

Check out the following useful flags:

FlagsDescription
-rRecursively watch the directory and subdirectories.
-mKeep watching the file or directory forever for new events or until β€œ--timeout” expires.
-eListen for specific events such as access, modify, open, close, create, delete, etc.
-tStop watching the file or directory after the timeout (β€œ0” is for never).
--excludeIgnore watching the events in the specified file or directory.
--excludeiSame as above, but case-insensitive.
--includeIgnore watching events on all other files or directories, except for the matching regular expression.
-dSame as β€œ-mβ€œ, except that the background logging events for the file or directory specified are run.
-oPrint the output to a specified file.
-cPrint events in CSV format.

Monitor the Events on File and Directory Using Inotifywait

When you start monitoring a file using inotifywait, you’ll be informed of when a process opens, modifies, reads, closes, moves, or deletes the file. Monitoring the directory also reveals events in any files within it.

The following is a tree hierarchy of a directory containing several files and subdirectories.

directory structure for inotify

We will use this directory tree for various examples to demonstrate inotifywait usage.

So, to monitor all events occurring in our directory tree, whether triggered by us or any process, we use the β€œinotifywait” command with the β€œ-r” flag for recursive monitoring of the directory and its contents. Additionally, we must include the β€œ-m” flag to continuously monitor events until manually interrupted by the user.

$ inotifywait -r -m mydir/

Output:

monitoring content of directory using inotifywait

Now that we’ve begun monitoring the directory’s content, it will wait for an event to happen. To demonstrate, let’s open a new terminal window and create a new file within β€œmydir/dir2” using the β€œecho "Linux TLDR" > mydir/dir2/file1” command. Once the file is created, return back to the shell where we ran inotifywait to see its output.

checking inotifywait events

You can see that every event that occurred in the directory while creating the file is listed, and the output is organized into three columns: the base directory, the event, and the file that triggered the event.

Now let’s list the contents of β€œmydir/dir2β€œ, access the newly created file, and then create a new directory using the following command:

$ ls mydir/dir2
$ cat mydir/dir2/file1
$ mkdir mydir/dir2/mydir1

Now let’s return to our shell with the inotifywait running:

monitoring multiple events on directory using inotifywait

As you can see, inotifywait carefully monitors every event in the directory. Additionally, if you want to monitor specific events like creation or deletion, you can specify these events with the β€œ-e” flag. For example, the following command will only monitor for create and delete events.

πŸ’‘
There are a total of forty events that you can use, starting with access, modify, attrib, close_write, close_nowrite, close, open, moved_to, moved_from, move, move_self, create, delete, delete_self, and unmount.
$ inotifywait -r -m -e create,delete mydir/

Output:

monitoring specific events using inotifywait

To exclude specific subdirectories from monitoring, use the β€œ--exclude” flag followed by the directory name. For example, the following command will not monitor any content from β€œmydir/dir1” while monitoring create and delete events for all other subdirectories.

$ inotifywait -r -m -e create,delete --exclude 'dir1/' mydir/

Output:

excluding directory from monitoring in inotifywait

Finally, keep in mind that when monitoring a single file using inotifywait, the file must be present in the specified directory at the time of command initialization. Additionally, if the user removes the file, event monitoring will cease, even if the file is later recreated.

To demonstrate, I’ll monitor an existing β€œfile1β€œ, reading its contents, then deleting the file and attempting to read its contents again, to see if events are detected.

$ inotifywait -r -m mydir/dir1/file1

Output:

monitoring a single file using inotifywait

As you can clearly see, after deleting the file, even if you recreate it, the events on the file won’t be monitored because specifying the file in inotifywait attaches its inode to the command, and deleting and recreating it changes the inode of the file.

So, to monitor such a file, you can monitor the parent directory and apply a specific regular expression to check only that particular file in the directory.

Get Desktop Notification When Events Occur Using a Shell Script

I’ll now show you how to use inotifywait in your shell script for monitoring file and directory changes, and receiving immediate desktop notifications.

First, create a file named β€œscript.sh” using your preferred text editor, either Vim or Nano, and then include the following Shebang to specify Bash shell.

#!/bin/bash

Then we will create a function that will display a desktop notification.

# Function to display desktop notification
notify() {
    notify-send "File Change" "$1"
}

Finally, we’ll execute a while loop to continuously monitor changes, specifying the β€œinotifywait” command to detect creation and deletion events within β€œmydir/β€œ, and alerting us with desktop notifications when an event occurs.

# Monitor "mydir/" directory for create and delete events
while true; do
    inotifywait -r -q -e create,delete mydir/ && notify "A file was created or deleted in mydir/"
done

Once you insert all the aforementioned lines into the β€œscript.sh” file, it will look like the one below:

shell script to monitor file changes using inotifywait

You can now save and close the file, and then assign executable permission to it using the chmod command.

$ chmod +x ./script.sh

Once done, run the shell script, and when a create or delete event occurs in β€œmydir/β€œ, it will be notified as a desktop notification.

$ ./script.sh

Output:

monitor changes and get notification

Final Word

This article has come to an end. I hope you find this article helpful, and as you can see, this tool can be very useful for tracking file and directory changes. Even if you’ve setup file synchronization between two devices, you can still monitor changes with this command.

Now, if you have any questions or queries related to the topic, do let me know in the comment section.

Till then, peace!

Join The Conversation

Users are always welcome to leave comments about the articles, whether they are questions, comments, constructive criticism, old information, or notices of typos. Please keep in mind that all comments are moderated according to our comment policy.