Monitor file system for new files.

I was looking into inotify (built into the 2.6.15 kernel) as a way to monitor a file system for changes, then do something once those changes occur.

I'm currently running RHEL AS3 (based on the 2.4 kernel) and have had...little success moving over to the 2.6 kernel (long story).

Does anyone know of any event driven utilities that can act when a file system has had a new file added to it?  

for example, user jim saves a file into /home/jim/watchme  I want this monitoring tool to notice the new file and copy it to a log directory as well (cp /home/jim/watchme/newfile /var/log/jim)

Bad example, but I hope it gets the jist of what I want to do accross.  If inotify is the only way to do this, then I'm back to the drawing board.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

You can add a cron job, going somthing like this:

find / -mtime 1 -exec cp -p {} /log/{} \;

This will show you the newly modified files in the system. not by thier creation time. Hopfully, this serves you good enoth.
use tripwire

its open source software.

Ziggie013Author Commented:
guruyaya - is there a way to drop the path when it copies the file?  or do I have to create a directory for every directory that it's going to copy?  Neat script otherwise!

arvind - I'm not sure tripwire will do what I want.  It certainly tells me what files has been changed, but doesn't act upon that information, that I can see...
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

Well, you can`t do it using find alone, but you can do this:
for FILES in `find / -mtime 1`
    FILENAME=`echo $FILES | grep -o "[^\/]*$`
    cp $FILES /log/$FILENAME

Is that good?
Ziggie013Author Commented:
It's good, except doing this every minute could kill my server.

Do you know of any event driven methods of doing this?

If you do not mind to write some lines of C-code, you could use the "file alteration daemon" (famd).
Just write a little code snippet, which connects to famd, registers a given directory for monitoring and waits for an event, then takes any action you want and unregisters the monitor. See fam(3) for details.


just played around a little with fam. here's a quick and dirty code sample:

#include <stdio.h>
#include <fam.h>
#include <unistd.h>

FAMConnection* fc;
FAMRequest* fr;
FAMEvent* fe;

int main(int argc,char* argv[]){
  char* dir=argv[1];
  fc = (FAMConnection*) malloc(sizeof(FAMConnection));
  fr = (FAMRequest*) malloc(sizeof(FAMRequest));
      fe = (FAMEvent*) malloc(sizeof(FAMEvent));
          case FAMDeleted:
            printf("File %s deleted\n",fe->filename);
          case FAMCreated:
            printf("File %s created\n",fe->filename);

Save this snippet as "dmon.c". Then do a "gcc -lfam -o dmon dmon.c".
Call the sample prog as "./dmon <directory>". (make sure, that famd is running before - no error handling implemented)



Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
To second the last response see this article
and you might think about using a scripting language instead of C (it will be faster but maybe not as flexible as you might want).
Take a look @ this:
If speed is of the essence you might want to use the script languages as prototypes and then build the final model in C.
Pretty nice suggestions. As I'm also new to this topic (actually this thread made me to take a somehow deeper look into famd and how it works), I also appreciate to learn some other solutions (that's what I love on EE). Since I'm also learning ruby at the moment, I'm wondering, why I didn't have the idea to look for a fam ruby class. Bad mistake as one can see....;-)
So, many thanks for providing a new toy!

Hello.. as far as I understand what your needs are... I think one way to have this sort of automatic backup is to create a raid-1 volume (the mirroring one). BTW the second disc will be automatically updated every time the main FS will change.

With this solution you don't need to write any code, use any crontab entry nor use find.

Hope this can help
Ziggie013Author Commented:
Thanks for all your help all, but we went a different direction.  I am bookmarking this though if we ever visit this in the future.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.