1, installation Inotify-tools
Yum install make GCC gcc-c++ #安装编译工具
Inotify-tools:http://github.com/downloads/rvoicilas/inotify-tools/inotify-tools-3.14.tar.gz
Upload inotify-tools-3.14.tar.gz to the/USR/LOCAL/SRC directory
Cd/usr/local/src
Tar zxvf inotify-tools-3.14.tar.gz #解压
CD inotify-tools-3.14 #进入解压目录
./configure--prefix=/usr/local/inotify #配置
Make #编译
Make install #安装
2. Set the system path Vi/etc/profile add: Export path=/usr/local/inotify/bin: $PATH source/etc/profile
parameter DescriptionSyntax:inotifywait [-HCMRQ] [-e] [-t] [--format] [--timefmt] [...]
-h,–help
Output Help information
@
Exclude files that you do not need to monitor, either a relative path or an absolute path.
–fromfile
Read from a file a file that needs to be monitored or excluded, a file line, and the excluded files begin with @.
-m,–monitor
Receives a thing without exiting, executes indefinitely. The default behavior is to exit immediately after receiving a thing.
-d,–daemon
Like –monitor, in addition to running in the background, you need to specify –outfile to export things to a file. Also means the use of –syslog.
-o,–outfile
Output things to a file instead of the standard output.
-s,–syslog
Output error message to System log
-r,–recursive
Monitors all subdirectories in a directory.
-q,–quiet
Specified once, does not output details, specified two times, except for fatal errors, will not output any information.
–exclude
Regular matching files that need to be excluded are case-sensitive.
–excludei
Regular matches the files that need to be excluded, ignoring the case.
-T, –timeout
Set the time-out, if 0, to execute indefinitely.
-E, –event
Specifies the monitored events.
-c,–csv
Output CSV format.
–timefmt
Specify the time format, such as ("%" after the case that represents a different format, such as%y for 2-bit years)%y-%m-%d Date: 2012-10-13%h:%m:%s time: 15:45:05 whether to display the time specified by this parameter, depending on whether "%T" is specified in the –format option.
–format
Specifies the output format.
%w indicates the directory where the event occurred
%f indicates the file in which the event occurred
%e indicates that an event occurred
%xe events are separated by "X"
%T displays the time format defined by –TIMEFMT
parameter Descriptionsyntax:inotifywatch [-HVZRQF] [-e] [-t] [-a] [-d] [...]
Parameters:
-h,–help
Output Help information
-v,–verbose
Output details
@
Exclude files that you do not need to monitor, either a relative path or an absolute path.
–fromfile
Read from a file a file that needs to be monitored or excluded, a file line, and the excluded files begin with @.
-z,–zero
The rows and columns of the output table, even if the element is empty
–exclude
Regular matching files that need to be excluded are case-sensitive.
Example: To exclude the TEST1,TEST2,CC directory under the/HOME/MJB directory, this can be written--exclude= "/home/mjb/(test1/|test2/|cc/)". Multiple directories or files must be "|" Separately, you cannot have two--exclude in the command line, otherwise the final--exclude will overwrite the other. The system simply finds out in the file path if there are any characters specified in the above parameters, and excludes them if any. So I added "/" Behind the test1. Otherwise/home/mjb/test123 will also be excluded.
–excludei
Regular matches the files that need to be excluded, ignoring the case.
-r,–recursive
Monitors all subdirectories in a directory.
-T, –timeout
Setting the time-out period
-E, –event
Listens only for the specified events.
-A, –ascending
In ascending order of the specified events.
-D, –descending
Sorts the specified events in descending order. Can listen to events
Access file read
Modify file changes.
Attrib file property changes, such as permissions, timestamps, and so on.
Close_write files opened in writable mode are turned off, and do not mean that the file must have been written to the data.
Close_nowrite files opened in read-only mode are closed.
The close file is closed, regardless of how it was opened.
The open file opens.
Moved_to a file or directory is moved to the listening directory, and this event is triggered even if it is moved within the same directory.
Moved_from a file or directory is moved out of the listening directory, and this event is triggered even if it is moved within the same directory.
Move includes moved_to and Moved_from
The move_self file or directory is removed and no longer listens for this file or directory.
Create file or directory creation
Delete file or directory deletion
Delete_self file or directory is removed and then no longer listens for this file or directory
The Unmount file system is not mounted, and the file system is no longer listening.
Examples of Use1, real-time monitoring of home/home all events (including file access, write, modify, delete, etc.)
Inotifywait-rm/home 2, monitoring/var/log/messeges in the httpd of the log
#!/bin/sh
While Inotifywait-e modify/var/log/messages; Do
If Tail-n1/var/log/messages | grep httpd; Then
Kdialog--msgbox "Apache needs love!"
Fi
Done
3. Statistics on/home file system events
Inotifywatch-v-E access-e modify-t 60-r/Home 4, monitoring/home/www directory and its subdirectories inotifywait-m-r-d-O/VAR/LOG/CHANGE.LOG–TIMEF Mt '%F%T ' –format '%T%w%f%e '-e close_write-e create/home/www where/var/log/change.log is the log path,/HOME/WWW is the path to monitoring
Operation Example
Inotifywait-m-r-d-o/var/log/change2.log--timefmt '%F%T '--format '%T%w%F%e '/data/backup
INotify Monitoring file changes
