1incrontab(5) incron documentation incrontab(5)
2
6 incrontab - tables for driving inotify cron (incron)
7
9 An incrontab file contains instructions to the incrond(8) daemon of the
10 general form: "run this command on these file events". There are two
11 categories of tables: system tables (with root privileges) and user
12 tables (with user privileges).
13 System tables are (by default) located in /etc/incron.d and may have
15 any names. Each system table exists separately inside incron and their
16 watches never collide.
17 Each user has their own table, and commands in any given incrontab will
19 be executed as the user who owns the incrontab. System users (such as
20 apache, postfix, nobody etc.) may have their own incrontab.
21 incrontab files are read when the incrond(8) daemon starts and after
23 any change (incrontab file are being hooked when incrond is running).
24 Blank lines are ignored. The general line format is the following:
26 <path> <mask> <command>
28 Where path is an absolute filesystem path, mask is an event mask (in
30 symbolic or numeric form) and command is an executable file (or a
31 script) with its arguments. See bellow for event mask symbols. The exe‐
32 cutable file may be noted as an absolute path or only as the name
33 itself (PATH locations are examined).
34 Please remember that the same path may occur only once per table (oth‐
36 erwise only the first occurrence takes effect and an error message is
37 emitted to the system log). Please not that the * wildcard is allowed
38 to observe a range of files.
39
42 These basic event mask symbols are defined:
43 IN_ACCESS File was accessed (read) (*)
45 IN_ATTRIB Metadata changed (permissions, timestamps, extended
46 attributes, etc.) (*)
47 IN_CLOSE_WRITE File opened for writing was closed (*)
48 IN_CLOSE_NOWRITE File not opened for writing was closed (*)
49 IN_CREATE File/directory created in watched directory (*)
50 IN_DELETE File/directory deleted from watched directory (*)
51 IN_DELETE_SELF Watched file/directory was itself deleted
52 IN_MODIFY File was modified (*)
53 IN_MOVE_SELF Watched file/directory was itself moved
54 IN_MOVED_FROM File moved out of watched directory (*)
55 IN_MOVED_TO File moved into watched directory (*)
56 IN_OPEN File was opened (*)
57 When monitoring a directory, the events marked with an asterisk (*)
59 above can occur for files in the directory, in which case the name
60 field in the returned event data identifies the name of the file within
61 the directory.
62 The IN_ALL_EVENTS symbol is defined as a bit mask of all of the above
64 events. Two additional convenience symbols are IN_MOVE, which is a com‐
65 bination of IN_MOVED_FROM and IN_MOVED_TO, and IN_CLOSE which combines
66 IN_CLOSE_WRITE and IN_CLOSE_NOWRITE.
67 The following further symbols can be specified in the mask:
69 IN_DONT_FOLLOW Don't dereference pathname if it is a symbolic link
71 IN_ONESHOT Monitor pathname for only one event
72 IN_ONLYDIR Only watch pathname if it is a directory
73 Additionally, there is a symbol which doesn't appear in the inotify
75 symbol set. It is loopable=true. This symbol disables monitoring events
76 until the current one is completely handled (until its child process
77 exits). Also, there is the symbol recursive=false. This symbol limits
78 the observation on the specified directory and does not include subdi‐
79 rectories. Finally, there is also the symbol dotdirs=true. This symbol
80 will include the hidden directories (where the names starts with a dot)
81 in the observation.
82
85 The following wildards may be used inside command specification:
86 $$ dollar sign
88 $@ watched filesystem path (see above)
89 $# event-related file name
90 $% event flags (textually)
91 $& event flags (numerically)
92
95 These are some example rules which can be used in an incrontab file:
96 /tmp IN_ALL_EVENTS abcd $@/$# $%
98 /usr/bin IN_ACCESS,loopable=true abcd $#
100 /home IN_CREATE /usr/local/bin/abcd $#
102 /home IN_CREATE,dotdirs=true /usr/local/bin/abcd $#
104 /home IN_CREATE,recursive=false /usr/local/bin/abcd $#
106 /var/log 12 abcd $@/$#
108 The first line monitors all events on the /tmp directory. When an event
110 occurs it runs a application called 'abcd' with the full path of the
111 file as the first arguments and the event flags as the second one.
112 The second line monitors accesses (readings) on the /usr/bin directory.
114 The application 'abcd' is run as a handler and the appropriate event
115 watch is disabled until the program finishes. The file name (without
116 the directory path) is passed in as an argument.
117 The third example is used for monitoring the /home directory for newly
119 create files or directories (it practically means an event is sent when
120 a new user is added). This event is processed by a program specified by
121 an absolute path.
122 The fourth example is the third example, but it will include hidden
124 directories in the observation.
125 The fifth example is the third example, but it will exclude sub-direc‐
127 tories from the observation.
128 And the final line shows how to use numeric event mask instead of tex‐
130 tual one. The value 12 is exactly the same as IN_ATTRIB,IN_CLOSE_WRITE.
131
134 incrond(8), incrontab(1), incron.conf(5)
135
137 Andreas Altair Redmer <altair.ibn.la.ahad.sy@gmail.com> (please report
138 bugs to https://github.com/ar-/incron/issues ). Lukas Jelinek
139 <lukas@aiken.cz> .
140
142 This program is free software. It can be used, redistributed and/or
143 modified under the terms of the GNU General Public License, version 2.
144Lukas Jelinek 0.5.12 incrontab(5)