Python pyinotify package for File System Monitoring

This article mainly introduces the pyinotify package used to monitor file systems in Python. pyinotify is based on the inotify event-driven mechanism. For more information, see What is inotify:

• Inotify is an event-driven notification mechanism. Inotify provides a simple API that uses the smallest file descriptor and allows fine-grained monitoring. Communication with inotify is implemented through system calls. The available functions are as follows:
• Inotify_init is a system call used to create an inotify instance and returns a file descriptor pointing to the instance.
• Inotify_init1 is similar to inotify_init and carries an additional identifier. If these additional flags are not specified, they will use the same value as inotify_init.
• Inotify_add_watch monitors files or directories and specifies the events to be monitored. Flag is used to control whether to add events to existing monitoring, whether to monitor only directories represented by paths, whether to track symbolic links, and whether to perform one-time monitoring, when an event occurs for the first time, the monitoring is stopped.
• Inotify_rm_watch removes monitoring items from the monitoring list.
• Read reads the cache containing one or more event information.
• Close closes the file descriptor and removes all monitoring data on the descriptor. When all file descriptors of an instance are disabled, the resources and lower-level objects are released for the kernel to use again.

Therefore, a typical monitoring program needs to perform the following operations:

• Use inotify_init to open a file descriptor
• Add one or more monitors
• Wait event
• Process events, then return and wait for more events
• When the monitoring is no longer active, or after receiving a signal, close the file descriptor, clear the file, and then exit.

Install the pyinotify package

git clone https://github.com/seb-m/pyinotify.gitcd pyinotify/python setup.py install

Inotify can monitor the following file system events:

IN_ACCESS: The file is accessed.
IN_MODIFY, the file is written
IN_ATTRIB: file attributes are modified, such as chmod, chown, and touch.
IN_CLOSE_WRITE, writable file closed
IN_CLOSE_NOWRITE: the file cannot be written.
IN_OPEN, the file is open
IN_MOVED_FROM: The file is removed, such as mv.
IN_MOVED_TO: The file is moved, such as mv and cp.
IN_CREATE, create a new file
IN_DELETE: The file is deleted, such as rm.
IN_DELETE_SELF: indicates that an executable file is deleted when it is executed.
IN_MOVE_SELF, self-moving, that is, an executable file moves itself during execution
IN_UNMOUNT, the host file system is umount
IN_CLOSE, the file is closed, equivalent to (IN_CLOSE_WRITE | IN_CLOSE_NOWRITE)
IN_MOVE: The file is moved, equivalent to (IN_MOVED_FROM | IN_MOVED_TO)

Pyinotify example

#! /Usr/bin/env python # encoding: UTF-8 import osfrom pyinotify import WatchManager, Notifier, \ ProcessEvent, IN_DELETE, IN_CREATE, IN_MODIFY class EventHandler (ProcessEvent ): "event processing" def process_IN_CREATE (self, event): print "Create file: % s" % OS. path. join (event. path, event. name) def process_IN_DELETE (self, event): print "Delete file: % s" % OS. path. join (event. path, event. name) def process_IN_MODIFY (self, event): print "Modify file: % s" % OS. path. join (event. path, event. name) def FSMonitor (path = '. '): wm = WatchManager () mask = IN_DELETE | IN_CREATE | IN_MODIFY notifier = Notifier (wm, EventHandler () wm. add_watch (path, mask, auto_add = True, rec = True) print 'now starting monitor % s' % (path) while True: try: notifier. process_events () if notifier. check_events (): notifier. read_events () cipher t KeyboardInterrupt: notifier. stop () break if _ name _ = "_ main _": FSMonitor ('/home/firefoxbug ')