Linux systems monitor changes to files and folders under a directory

Inotifywait is a tool that can monitor file changes in real-time, using the inotify mechanism in the Linux kernel to implement monitoring capabilities.

1. View Kernel version
2. [Email protected]oracle ~]# uname-r
3. 2.6.32-220.el6.i686

1. Installing Inotify-tools
2. Yum Install-y Inotify-tools

Test monitoring/etc,inotifywait-m/etc

Use putty to connect to the server, open another terminal, with vim to edit the/etc/passwd, the other terminal display the corresponding monitoring information

inotifywait Command parameter description:the-M option indicates monitor, that is, turn on monitoringthe-r option indicates recursive monitoring, but it is slower, and if you monitor the/etc directory, the modified files in the subdirectories can be monitored.

The-e option specifies that the events to be monitored include: access, modify, attrib, close_write, Close_nowrite, close, open, moved_to, Moved_from, move, Move_self, create, delete, Delete_self, unmount.

1. If the/etc/passwd file is modified, the event is recorded in the file/root/modify_passwd.txt
2. Inotifywait-m/etc/passwd-e Modify >/root/modify_passwd.txt

If you do not add the parameter-E, the default is to monitor all events, in the daily operations, this tool can help you monitor the server on the important files and important directory changes.

Linux systems monitor changes to files and folders under a directory