Monitor changes to a file

[Alex Dean]

On Feb 28, 2011, at 5:33 PM, Kurt Granroth wrote:

> Maybe incron (cron version of inotify) could trigger a script that runs 'stat' on the file.  Still wouldn't give me the "who", though.

At first glance, I thought inotify would be perfect for this.  But (as you say) it doesn't appear that inotify events contain any information about which process performed the change which trigged the event.

struct inotify_event {
        __s32 wd;             /* watch descriptor */
        __u32 mask;           /* watch mask */
        __u32 cookie;         /* cookie to synchronize two events */
        __u32 len;            /* length (including nulls) of name */
        char name[0];        /* stub for possible name */
};
http://www.linuxjournal.com/article/8478?page=0,1

There are some handy-looking tools in https://github.com/rvoicilas/inotify-tools/wiki/.  Seems like you should be able to write a shell script to wait for a modification event on your file, and run stat or lsof when the file is changed.  That's not perfect, since the modifying process might be done by the time lsof actually runs, but it seems like it's worth a try.

alex