0

On a UNIX system, everything is a file; if something is not a file, it is a process. this is an advantage of linux file system, but a have a question here !!

how can I detect if a file has been created or changed or removed by user or program ?

I try to do this with inotify but doesn't work with kernel version 3.4 in openwrt distribution

thanks

which_part
  • 792
  • 3
  • 11
  • 26
Anis_Stack
  • 3,306
  • 4
  • 30
  • 53

1 Answers1

1

Have you tried the stat command? If you cannot use inotify then you probably cannot use inotifywait as it uses the inotify interface.

You can get information about file creation and modification directly from its output.

The removed part (when a user or a program removes a file) cannot be accessed direclty. Unix provides the atime, mtime and ctime timestamps.

Atime is the time of the last access of contents. Ctime is the time of the last modification of the inode - metadata. Mtime is the time of the last modification of contents.

So no Removed time can directly be accesed. You can check if a file is deleted via the timestamps of the directory that the file was included.

sestus
  • 1,875
  • 2
  • 16
  • 16
  • it can detect in real time the change of file ? it means if file is modified it send signal to scripts to notify it by the change ? – Anis_Stack Jul 07 '14 at 14:57
  • @Anis_Stack there is not an easy way that you can get notifications. You can write some scripts I guess that will execute the stat command, and use some reg exps to grab the modified time – sestus Jul 07 '14 at 16:07