• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 744
  • Last Modified:

Monitor file system for new files.

I was looking into inotify (built into the 2.6.15 kernel) as a way to monitor a file system for changes, then do something once those changes occur.

I'm currently running RHEL AS3 (based on the 2.4 kernel) and have had...little success moving over to the 2.6 kernel (long story).

Does anyone know of any event driven utilities that can act when a file system has had a new file added to it?  

for example, user jim saves a file into /home/jim/watchme  I want this monitoring tool to notice the new file and copy it to a log directory as well (cp /home/jim/watchme/newfile /var/log/jim)

Bad example, but I hope it gets the jist of what I want to do accross.  If inotify is the only way to do this, then I'm back to the drawing board.
0
Ziggie013
Asked:
Ziggie013
  • 3
  • 3
  • 2
  • +3
2 Solutions
 
guruyayaCommented:
You can add a cron job, going somthing like this:

find / -mtime 1 -exec cp -p {} /log/{} \;

This will show you the newly modified files in the system. not by thier creation time. Hopfully, this serves you good enoth.
0
 
arvindCommented:
use tripwire

http://www.tripwire.com/products/enterprise/ost/

its open source software.



0
 
Ziggie013Author Commented:
guruyaya - is there a way to drop the path when it copies the file?  or do I have to create a directory for every directory that it's going to copy?  Neat script otherwise!

arvind - I'm not sure tripwire will do what I want.  It certainly tells me what files has been changed, but doesn't act upon that information, that I can see...
0
NEW Veeam Backup for Microsoft Office 365 1.5

With Office 365, it’s your data and your responsibility to protect it. NEW Veeam Backup for Microsoft Office 365 eliminates the risk of losing access to your Office 365 data.

 
guruyayaCommented:
Well, you can`t do it using find alone, but you can do this:
for FILES in `find / -mtime 1`
do
    FILENAME=`echo $FILES | grep -o "[^\/]*$`
    cp $FILES /log/$FILENAME
done.

Is that good?
0
 
Ziggie013Author Commented:
It's good, except doing this every minute could kill my server.

Do you know of any event driven methods of doing this?

0
 
XoFCommented:
If you do not mind to write some lines of C-code, you could use the "file alteration daemon" (famd).
Just write a little code snippet, which connects to famd, registers a given directory for monitoring and waits for an event, then takes any action you want and unregisters the monitor. See fam(3) for details.

HTH,

-XoF-
0
 
XoFCommented:
just played around a little with fam. here's a quick and dirty code sample:

#include <stdio.h>
#include <fam.h>
#include <unistd.h>

FAMConnection* fc;
FAMRequest* fr;
FAMEvent* fe;

int main(int argc,char* argv[]){
  char* dir=argv[1];
  fc = (FAMConnection*) malloc(sizeof(FAMConnection));
  fr = (FAMRequest*) malloc(sizeof(FAMRequest));
  FAMOpen(fc);
  if(fc){
    FAMMonitorDirectory(fc,dir,fr,NULL);
    if(fr){
      fe = (FAMEvent*) malloc(sizeof(FAMEvent));
      while(1){
        FAMNextEvent(fc,fe);
        switch(fe->code){
          case FAMDeleted:
            printf("File %s deleted\n",fe->filename);
            break;
          case FAMCreated:
            printf("File %s created\n",fe->filename);
            break;
        }
      }
      FAMCancelMonitor(fc,fr);
      free(fe);
    }
    FAMClose(fc);
  }
  free(fr);
  free(fc);
  return(FAMErrno);
}


Save this snippet as "dmon.c". Then do a "gcc -lfam -o dmon dmon.c".
Call the sample prog as "./dmon <directory>". (make sure, that famd is running before - no error handling implemented)

HTH,

-XoF-
0
 
badianeCommented:
To second the last response see this article
http://www.devchannel.org/devtoolschannel/04/05/13/2146252.shtml
and you might think about using a scripting language instead of C (it will be faster but maybe not as flexible as you might want).
Take a look @ this:
http://www.pablotron.org/software/fam-ruby/examples/dirmon.rb
http://www.macosxhints.com/article.php?story=20031001073403810
http://ayesha.phys.virginia.edu/~bryan/projects/famids/
If speed is of the essence you might want to use the script languages as prototypes and then build the final model in C.
0
 
XoFCommented:
badiane:
Pretty nice suggestions. As I'm also new to this topic (actually this thread made me to take a somehow deeper look into famd and how it works), I also appreciate to learn some other solutions (that's what I love on EE). Since I'm also learning ruby at the moment, I'm wondering, why I didn't have the idea to look for a fam ruby class. Bad mistake as one can see....;-)
So, many thanks for providing a new toy!

Regards,
-XoF-
0
 
barreroCommented:
Hello.. as far as I understand what your needs are... I think one way to have this sort of automatic backup is to create a raid-1 volume (the mirroring one). BTW the second disc will be automatically updated every time the main FS will change.

With this solution you don't need to write any code, use any crontab entry nor use find.

Hope this can help
0
 
Ziggie013Author Commented:
Thanks for all your help all, but we went a different direction.  I am bookmarking this though if we ever visit this in the future.
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

  • 3
  • 3
  • 2
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now