1INOTIFY(7)                 Linux Programmer's Manual                INOTIFY(7)
2
3
4

NAME

6       inotify - monitoring file system events
7

DESCRIPTION

9       The inotify API provides a mechanism for monitoring file system events.
10       Inotify can be used to monitor individual files, or to monitor directo‐
11       ries.   When  a  directory is monitored, inotify will return events for
12       the directory itself, and for files inside the directory.
13
14       The following system calls are used with this API: inotify_init(2)  (or
15       inotify_init1(2)),  inotify_add_watch(2), inotify_rm_watch(2), read(2),
16       and close(2).
17
18       inotify_init(2) creates an inotify instance and returns a file descrip‐
19       tor   referring   to  the  inotify  instance.   The  more  recent  ino‐
20       tify_init1(2) is like inotify_init(2), but provides  some  extra  func‐
21       tionality.
22
23       inotify_add_watch(2)  manipulates  the  "watch list" associated with an
24       inotify instance.  Each item ("watch") in the watch list specifies  the
25       pathname of a file or directory, along with some set of events that the
26       kernel should monitor for the file referred to by that pathname.   ino‐
27       tify_add_watch(2)  either  creates  a  new  watch  item, or modifies an
28       existing watch.  Each watch has a unique "watch descriptor", an integer
29       returned by inotify_add_watch(2) when the watch is created.
30
31       inotify_rm_watch(2) removes an item from an inotify watch list.
32
33       When  all  file  descriptors referring to an inotify instance have been
34       closed, the underlying object and its resources are freed for reuse  by
35       the kernel; all associated watches are automatically freed.
36
37       To  determine  what  events have occurred, an application read(2)s from
38       the inotify file descriptor.  If no events have so far occurred,  then,
39       assuming  a blocking file descriptor, read(2) will block until at least
40       one event occurs (unless interrupted by a signal,  in  which  case  the
41       call fails with the error EINTR; see signal(7)).
42
43       Each  successful read(2) returns a buffer containing one or more of the
44       following structures:
45
46           struct inotify_event {
47               int      wd;       /* Watch descriptor */
48               uint32_t mask;     /* Mask of events */
49               uint32_t cookie;   /* Unique cookie associating related
50                                     events (for rename(2)) */
51               uint32_t len;      /* Size of name field */
52               char     name[];   /* Optional null-terminated name */
53           };
54
55       wd identifies the watch for which this event occurs.  It is one of  the
56       watch descriptors returned by a previous call to inotify_add_watch(2).
57
58       mask contains bits that describe the event that occurred (see below).
59
60       cookie  is  a  unique  integer that connects related events.  Currently
61       this is only used for rename events, and allows the resulting  pair  of
62       IN_MOVE_FROM and IN_MOVE_TO events to be connected by the application.
63
64       The  name  field  is  only present when an event is returned for a file
65       inside a watched directory; it identifies the file pathname relative to
66       the  watched  directory.   This  pathname  is  null-terminated, and may
67       include further null bytes to align  subsequent  reads  to  a  suitable
68       address boundary.
69
70       The  len  field  counts  all  of  the bytes in name, including the null
71       bytes; the length of each inotify_event structure is  thus  sizeof(ino‐
72       tify_event)+len.
73
74       The  behavior  when  the buffer given to read(2) is too small to return
75       information about the next event depends on the kernel version: in ker‐
76       nels  before  2.6.21,  read(2)  returns 0; since kernel 2.6.21, read(2)
77       fails with the error EINVAL.
78
79   inotify events
80       The inotify_add_watch(2) mask argument and the mask field of  the  ino‐
81       tify_event  structure returned when read(2)ing an inotify file descrip‐
82       tor are both bit masks identifying inotify events.  The following  bits
83       can  be  specified in mask when calling inotify_add_watch(2) and may be
84       returned in the mask field returned by read(2):
85
86           IN_ACCESS         File was accessed (read) (*).
87           IN_ATTRIB         Metadata changed, e.g., permissions,  timestamps,
88                             extended  attributes,  link  count  (since  Linux
89                             2.6.25), UID, GID, etc. (*).
90           IN_CLOSE_WRITE    File opened for writing was closed (*).
91           IN_CLOSE_NOWRITE  File not opened for writing was closed (*).
92           IN_CREATE         File/directory created in watched directory (*).
93           IN_DELETE         File/directory  deleted  from  watched  directory
94                             (*).
95           IN_DELETE_SELF    Watched file/directory was itself deleted.
96           IN_MODIFY         File was modified (*).
97           IN_MOVE_SELF      Watched file/directory was itself moved.
98           IN_MOVED_FROM     File moved out of watched directory (*).
99           IN_MOVED_TO       File moved into watched directory (*).
100           IN_OPEN           File was opened (*).
101
102       When  monitoring  a  directory,  the events marked with an asterisk (*)
103       above can occur for files in the directory,  in  which  case  the  name
104       field  in  the  returned inotify_event structure identifies the name of
105       the file within the directory.
106
107       The IN_ALL_EVENTS macro is defined as a bit mask of all  of  the  above
108       events.   This macro can be used as the mask argument when calling ino‐
109       tify_add_watch(2).
110
111       Two  additional  convenience  macros  are  IN_MOVE,  which  equates  to
112       IN_MOVED_FROM|IN_MOVED_TO,    and    IN_CLOSE    which    equates    to
113       IN_CLOSE_WRITE|IN_CLOSE_NOWRITE.
114
115       The following further bits can be specified in mask when  calling  ino‐
116       tify_add_watch(2):
117
118           IN_DONT_FOLLOW (since Linux 2.6.15)
119                             Don't  dereference  pathname  if it is a symbolic
120                             link.
121           IN_MASK_ADD       Add (OR) events to watch mask for  this  pathname
122                             if it already exists (instead of replacing mask).
123           IN_ONESHOT        Monitor  pathname for one event, then remove from
124                             watch list.
125           IN_ONLYDIR (since Linux 2.6.15)
126                             Only watch pathname if it is a directory.
127
128       The following bits may be set in the mask field returned by read(2):
129
130           IN_IGNORED        Watch    was     removed     explicitly     (ino‐
131                             tify_rm_watch(2))   or  automatically  (file  was
132                             deleted, or file system was unmounted).
133           IN_ISDIR          Subject of this event is a directory.
134           IN_Q_OVERFLOW     Event queue overflowed (wd is -1 for this event).
135           IN_UNMOUNT        File  system  containing   watched   object   was
136                             unmounted.
137
138   /proc interfaces
139       The following interfaces can be used to limit the amount of kernel mem‐
140       ory consumed by inotify:
141
142       /proc/sys/fs/inotify/max_queued_events
143              The value in this file is used when an  application  calls  ino‐
144              tify_init(2)  to set an upper limit on the number of events that
145              can be queued to the corresponding inotify instance.  Events  in
146              excess  of this limit are dropped, but an IN_Q_OVERFLOW event is
147              always generated.
148
149       /proc/sys/fs/inotify/max_user_instances
150              This specifies an upper limit on the number of inotify instances
151              that can be created per real user ID.
152
153       /proc/sys/fs/inotify/max_user_watches
154              This  specifies an upper limit on the number of watches that can
155              be created per real user ID.
156

VERSIONS

158       Inotify was merged into the 2.6.13 Linux kernel.  The required  library
159       interfaces  were  added  to  glibc  in  version  2.4.  (IN_DONT_FOLLOW,
160       IN_MASK_ADD, and IN_ONLYDIR were only added in version 2.5.)
161

CONFORMING TO

163       The inotify API is Linux-specific.
164

NOTES

166       Inotify file descriptors can be monitored using select(2), poll(2), and
167       epoll(7).  When an event is available, the file descriptor indicates as
168       readable.
169
170       Since Linux 2.6.25, signal-driven I/O  notification  is  available  for
171       inotify  file  descriptors;  see the discussion of F_SETFL (for setting
172       the O_ASYNC flag), F_SETOWN, and F_SETSIG in fcntl(2).   The  siginfo_t
173       structure (described in sigaction(2)) that is passed to the signal han‐
174       dler has the following fields set: si_fd is set  to  the  inotify  file
175       descriptor number; si_signo is set to the signal number; si_code is set
176       to POLL_IN; and POLLIN is set in si_band.
177
178       If successive output  inotify  events  produced  on  the  inotify  file
179       descriptor  are  identical  (same wd, mask, cookie, and name) then they
180       are coalesced into a single event if the older event has not  yet  been
181       read (but see BUGS).
182
183       The  events returned by reading from an inotify file descriptor form an
184       ordered queue.  Thus, for example, it is guaranteed that when  renaming
185       from  one  directory to another, events will be produced in the correct
186       order on the inotify file descriptor.
187
188       The FIONREAD ioctl(2) returns the number of  bytes  available  to  read
189       from an inotify file descriptor.
190
191       Inotify  monitoring  of directories is not recursive: to monitor subdi‐
192       rectories under a directory, additional watches must be created.
193

BUGS

195       In kernels before 2.6.16, the IN_ONESHOT mask flag does not work.
196
197       Before kernel 2.6.25, the kernel code that  was  intended  to  coalesce
198       successive  identical  events  (i.e.,  the two most recent events could
199       potentially be coalesced if the older had not yet  been  read)  instead
200       checked  if  the  most  recent event could be coalesced with the oldest
201       unread event.
202

SEE ALSO

204       inotify_add_watch(2),    inotify_init(2),    inotify_init1(2),     ino‐
205       tify_rm_watch(2),   read(2),   stat(2),  Documentation/filesystems/ino‐
206       tify.txt.
207

COLOPHON

209       This page is part of release 3.25 of the Linux  man-pages  project.   A
210       description  of  the project, and information about reporting bugs, can
211       be found at http://www.kernel.org/doc/man-pages/.
212
213
214
215Linux                             2008-11-18                        INOTIFY(7)
Impressum