Detect file update from modification time

Question

Is there a way to see how often a file is being updated?
I mean I need to see if the modification time of a file is updated in a dynamic way (same as tail shows if the file is updated in a dynamic way).
I can not use e.g. tail since the contents of the file are not appended, but overwritten and could be overwriten with the same value so I can not make a concusion.

http://www.noah.org/wiki/Inotify,_FAM,_Gamin – symcbean Feb 22 '13 at 09:59 — symcbean, Feb 22 '13 at 09:59

score 3 · Answer 1 · answered Feb 22 '13 at 09:02

3

How about this:

watch -n 1 'stat /path/to/the/file'

answered Feb 22 '13 at 09:02

quanta

51,413
19
159
217

I see this:`Modify: 2013-02-22 04:25:07.000000000 -0500` the timestamp would dynamically increase had the file been constantly updated, correct? – Jim Feb 22 '13 at 09:26
Yes, just try it. – quanta Feb 22 '13 at 09:27

user9517 · Answer 2 · 2013-02-22T09:43:09.307

You can use inotifywait to do this much more efficiently for example

inotifywait -e modify -m  --timefmt "%F %T" --format "%T %e" /tmp/fred/1

Will watch the file /tmp/fred/1 for modify events so updading it produces output like

2013-02-22 09:30:26 MODIFY
2013-02-22 09:30:26 MODIFY

You can log multiple events, change the time format (the timefmt takes strftime formatting) output to a file and daemonize e.g

inotifywait -o /tmp/watch.out -d -e modify -m  --timefmt "%F %T" --format "%T %e" /tmp/fred/1

so now you can just tail /tmp/watch.out.

score 1 · Answer 3 · answered Feb 22 '13 at 10:20

1

You can also use 'audit' daemon /etc/audit/auditd.conf is configuration file for audit daemon /etc/audit/audit.rules contains audit rules

answered Feb 22 '13 at 10:20

friendyogi

39
1
1
4

Detect file update from modification time

3 Answers3