If the filename ($#) for an event contains a tilde character (~) then the associated command from incrontab does not run. (Nothing shows up in my system log.)

This bug report is a copy of https://bugs.debian.org/443703

[martin f krafft]

Please let me use ~ (or $HOME) and other variables in incrontab table entries. I am really not a fan of hardcoding the path to my homedirectory.

Originals:
http://bts.aiken.cz/view.php?id=159
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=419518

If incron launches a command it does silently discard and drop its
output. That is very bad, because it makes logging of the output
impossible.

Steps to reproduce:

1. Create a script test.sh which does simply echo something (e.g. Hello World)
2. Create a incrontab entry which executes this script and pipes it output to logger, e.g. $CMD | logger -t cmd
3. Trigger the event that causes the CMD to execute

The best approach would be to do what crond does about output.

I'm trying to deploy an image in OpenShift with incrond, as far as with Openshift the docker pods cannot (or at least should not) run as root I'm trying to run the incrond as a regular user but I am not getting too much success right now.

After fixing a problem permission in /var/run which prevented the daemon to start now it simply does not show any output when launched, if I launch the daemon with root it works:

[root@lrcc-VirtualBox incron]# /usr/local/sbin/incrond -n
incrond[758]: starting service (version 0.5.12, built on Jul 19 2018 14:46:38)
incrond[758]: loading system tables
incrond[758]: loading user tables
incrond[758]: ready to process filesystem events
^Cincrond[758]: stopping service
[root@lrcc-VirtualBox incron]#
[root@lrcc-VirtualBox incron]# su - datafeed -c "/usr/local/sbin/incrond -n"

Is it possible to run incrond -n with non root user?

Thanks

I've got an incrontab rule set up to react to a file being added to a particular directory on my ubuntu box, and run a script. This works fine, but my goal is to print the output of that script to a file.

I've tried a few different ways to go about it, and the only way I've been able to get it working so far is to take the generated command that incrontab creates, and run it myself. So my thinking is that its possible, I'm likely just missing something obvious to an experience linux user.

I've shortened some of the commands for brevity's sake. "watchdir" "scriptPath" and "arg1" are all paths. I am bringing in two arguments to the script, arg1, and the filename wildcard from the cron job.

I've tried: (These run the script, but don't output to file)

watchdir IN_CREATE scriptPath arg1 $# >> /home/ubuntu/logs/log-$# 2>&1

watchdir IN_CREATE scriptPath arg1 $# &>> /home/ubuntu/logs/log-$#

(These do nothing at all)

watchdir IN_CREATE /bin/bash scriptPath arg1 $# >> /home/ubuntu/log/log-$# 2>&1

watchdir IN_CREATE /bin/bash scriptPath arg1 $# &>> /home/ubuntu/log/log-$#

If I run 'tail /var/log/syslog' and grab the command generated from the incrontab below and paste it into the shell, it works fine

watchdir IN_CREATE scriptPath arg1 $# &>> /home/ubuntu/logs/log-$#

This works

scriptPath arg1 mission-LHPUQ7ezcF0s0UwVgUR.txt &>> /home/ubuntu/logs/log-mission-LHPUQ7ezcF0s0UwVgUR.txt

Any insight as to what I could be missing?

incrontab:

/tmp/directory\ with\ spaces IN_ALL_EVENTS /usr/local/bin/incron-task $@/$#

log:

incrond: (me) CMD (/usr/local/bin/incron-task /tmp/directory with spaces/file\ with\ spaces)

Spaces in the directory, even if quoted ("$@"), cause the arguments to be split at every unescaped space in the path.

NTS: /incrontab.h:71

Originals:
http://bts.aiken.cz/view.php?id=159
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584134

Attaching usage log, for reference.

empting "log"

andres@terminus:~$ > /tmp/ic.log

verifying incrontab

andres@terminus:~$ incrontab -l
/home/andres/maps IN_MODIFY /usr/bin/make -C $@ > /tmp/ic.log 2>&1

modifying file

andres@terminus:~$ cat > maps/all.dot <<EOF

digraph
{
nod
}

validating date

andres@terminus:~$ date
Tue Jun 1 10:01:39 COT 2010

verifying syslog, the commands is "executed"

andres@terminus:~$ su -c "tail -5 /var/log/syslog"
Password:
Jun 1 10:01:33 terminus incrond[5924]: (andres) CMD (/usr/bin/make -C /home/and
res/maps > /tmp/ic.log 2>&1)
Jun 1 10:01:33 terminus incrond[5924]: (andres) CMD (/usr/bin/make -C /home/and
res/maps > /tmp/ic.log 2>&1)

verifying Makefile

andres@terminus:~$ cat maps/Makefile
all: all.png

all.png: all.dot
dot -Tpng $&lt; &gt; $@

log is empty

andres@terminus:~$ cat /tmp/ic.log

outfile is outdated

andres@terminus:~$ ls -l maps/all.png
-rw-r--r-- 1 andres andres 12457 2010-06-01 09:58 maps/all.png

the command works

andres@terminus:~$ /usr/bin/make -C /home/andres/maps > /tmp/ic.log 2>&1

outfile is updated

andres@terminus:~$ ls -l maps/all.png
-rw-r--r-- 1 andres andres 133 2010-06-01 10:04 maps/all.png

"log" is logging

andres@terminus:~$ cat /tmp/ic.log
make: Entering directory /home/andres/maps' dot -Tpng all.dot > all.png make: Leaving directory/home/andres/maps'

andres@terminus:~$ date
Tue Jun 1 10:05:11 COT 2010

weird

I propose to add additional option to filed, as

do not run abc program for .txt files
/var/mail IN_CLOSE_WRITE,exclude=.txt abc $@/$#

When doing a multiple directory create in a monitored path, whether recursive monitoring is enabled or not, incron-0.5.12 fails to properly trigger events for all the new folders, and occasionally segfaults. Tested with incron-0.5.12 compiled on RHEL5 and CentOS7.

Typical create command:
mkdir /u01/vsftp/testdir_00{1..9}

Sample error from /var/log/messages:
RHEL5:
Mar 17 11:55:51 indy kernel: incrond[16257]: segfault at fffffffffffffffe rip 00000000004089ec rsp 00007fff16d90240 error 4

CentOS7:
Mar 17 15:09:47 rudi kernel: traps: incrond[8998] general protection ip:4126b0 sp:7fff01f04308 error:0 in incrond[400000+1d000]

This behavior also appeared when copying or moving a directory tree into a (recursively) monitored path.

I can provide more detail on the environment and testing done if needed. I don't have the skills needed to trace the source of the problem in the code, so I'll leave that to your capable hands.

For exemple, with the file $toto.txt ; $# will return .txt

Hi,
I have used incrontab to check wether a new file is created in a directory, after checking with several parameter only IN_MOVE_TO gave me the correct Filename myfilename.jpg
IN_CREATE gives myfilename.jpg.part
Most of the output with ALL_EVENTS gives me myfilename.jpg.part

Have I done something wrong?

Ubuntu 16.04 LTE

Regards,
Jan

In a user incrontab, quoted arguments with embedded spaces are not being properly parsed. For instance, if the user incrontab has this single line:

/home/paulo/Google\ Drive/.insync-trash/ IN_CREATE,IN_MOVED_TO
/home/paulo/bin/push -t 'Deleted from GDrive' $#

the single quoted argument Deleted from GDrive is being treated as 3 separate arguments:

'Deleted
from
GDrive'

It looks as though the command line is not being handed to a shell for processing.

The changelog entry for version _0.5.10-2 (03/20/2014)_ mentions:

* Add a patch to fix bad handling of arguments with spaces in incrontabs

which seems to be the problem I'm facing. I couldn't find the issue in the bug tracker to confirm, I wonder if this patch has been removed ?

Steps to Reproduce:

1. Create a directory under /tmp:

mkdir -p /tmp/deleteme

1. Create a script that logs each of its arguments on syslog:

cat <<'EOF' >/tmp/x
#!/bin/bash
for arg in "$@"; do logger -t "$0" "$arg"; done
EOF

chmod +x /tmp/x

1. Add this line to the user incrontab:

/tmp/deleteme IN_CREATE /tmp/x "File: $#" "Flags: $%"

1. Install the incrontab
2. Create a file under /tmp/deleteme

touch /tmp/deleteme/xxx

1. Look at the message on syslog:

Mar 12 22:32:46 monk incrond[1849]: (paulo) CMD (/tmp/x "File: xxx" "Flags: IN_CREATE")
Mar 12 22:32:46 monk /tmp/x: "File:
Mar 12 22:32:46 monk /tmp/x: xxx"
Mar 12 22:32:47 monk /tmp/x: "Flags:
Mar 12 22:32:47 monk /tmp/x: IN_CREATE"

There should be only 2 unquoted messages logged, one for each argument:

Mar 12 22:32:46 monk /tmp/x: File: xxx
Mar 12 22:32:47 monk /tmp/x: Flags: IN_CREATE

Additional Information: I'm running _incron 0.5.10-2ubuntu1_ on _Xubuntu 14.10_ with _kernel
3.16.0-31-generic_.

Please let me know how I can help debug this further.

I'm trying to write a simple script that will take $# as an argument whenever a file is modified or created in a certain directory but I'm experiencing a very weird and inconsistent issue. I'll explain.

Let's put the following in incrontab:

$HOME/incron-test	IN_MODIFY,IN_CREATE	$HOME/incron-test.sh "$#"

Let's put a file with tricky characters like ( and ) a very long name.txt inside ~/incron-test. As far as I understand so far and after some experiments, I realized I need to quote $# because otherwise ~/incron-test.sh won't understand it receives a single argument, correct me if I'm wrong so far.

Inside ~/incron-test.sh, put the following:

echo "$@" > ~/incron-test.log

There should be no problem with this test.

I'm trying to perform the exact same setup only with a different directory - /var/lib/mpd/playlists. As you may have guessed, this is the where all of mpd's playlists are saved. The problem appears when I edit a playlist from a client like ncmpcpp. Here is incrond's journal when I do so:

Apr 30 22:05:23 NUC incrond[404]: PATH (/var/lib/mpd/playlists) FILE (#6946859) EVENT (IN_MODIFY)
Apr 30 22:05:23 NUC incrond[404]: (doron) CMD (/home/doron/.local/share/playlists/import.sh "#6946859")
Apr 30 22:05:23 NUC incrond[404]: PATH (/var/lib/mpd/playlists) FILE (Fabolus\ Seekers.m3u) EVENT (IN_CREATE)

What is #6946859? The playlist file I've edited in this test was Fabolus\ Seekers.m3u.

Hi I have tried to add the folder with space but its not added properly

I created a folder called Metrics Health To Print

and tried to add in incrontab as follows

/mnt/Metrics Health To Print IN_MODIFY /bin/bash /opt/data_transfer/sync_data.sh

I have added and saved then the data look like below

/mnt/Metrics 0 To Print IN_MODIFY /bin/bash /opt/data_transfer/sync_data.sh

This bug report is a copy of https://bugs.debian.org/599801

[dimas]

hello!
i'm using Debian Testing and have noticed that incron doesn't seem to process IN_DELETE_SELF action properly. shortly, i create a sample dir/file and add line like "/path IN_DELETE_SELF some_action", but when i delete watched file/dir (using rm or rmdir) nothing happens. other things i've tried seem to work right.

please see attached file for original action log (if /tmp/1 is a file, things go the same way)

srv>16:15:04 284 ~$ mkdir /tmp/1
srv>16:15:09 284 ~$ incrontab -e
table updated
srv>16:16:07 284 ~$ incrontab -d
requesting table reload for user 'srv'...
request done
srv>16:16:13 284 ~$ incrontab -l
/media/svalka/music/ IN_MODIFY,IN_CREATE,IN_DELETE,IN_MOVE /home/srv/.bin/reloadshares /tmp/1 IN_MODIFY,IN_DELETE_SELF touch /home/srv/stat
srv>16:17:13 284 ~$ ls /tmp/
1 museekd.lock museekd.srv
srv>16:17:18 284 ~$ touch /tmp/1
srv>16:17:28 284 ~$ ls
downloads progs tmp
srv>16:17:33 284 ~$ rm -rv /tmp/1
удален каталог: «/tmp/1»
srv>16:17:41 284 ~$ ls
downloads progs tmp

Original:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606770

incron sees, and presumably briefly loads, any dotfiles created by editors in
/etc/incron.d

Dec 11 08:22:18 icarus incrond[28662]: system table .test.swpx created, loading
Dec 11 08:22:18 icarus incrond[28662]: system table .test.swpx destroyed, removing
Dec 11 08:22:18 icarus incrond[28662]: system table .test.swp created, loading
Dec 11 08:22:18 icarus incrond[28662]: system table .test.swp destroyed, removing
Dec 11 08:22:23 icarus incrond[28662]: system table .test.swp created, loading
Dec 11 08:22:23 icarus incrond[28662]: system table .test.swp destroyed, removing

This was from editing a system table called "test".

This could lead to unexpected behaviour where there's two copies of the same
table, and commands could get run twice for the duration of the editing
session.

incron should ignore dotfiles in /etc/incron.d to prevent this.

I check limit of incron - it is 200 users (2 directoryes per user). After 200 users -new one can not monitoring filesystem events

When I do mkdir dir1 then mkdir dir1/dir2 it crashes incrond process and I have to manually restart it.
It works fine for files, just a directory within a directory.

This bug report is a copy of https://bugs.debian.org/715483

[Leo 'costela' Antunes]

Dear Maintainer,

incron's UserTable::MayAccess is too naive and reinvents the wheel when checking permissions on a watched dir. Since it only manually checks for uid/gid matching, it silently ignores folders that can actually be accessed according to the set ACLs (thought it does warn about "access denied" while reloading the incrontab).

For instance, the current handling of /media is done with per-user subdirs which all belong to root:root, but get ACLs set appropriately for the actual intended owner. This means incrontabs handling removable media don't work. I'm not sure why /media gets handled like this, but I hope you agree incron's inability to deal with ACLs is a problem regardless of this particular case's merits.

Cheers

Filenames can be malicious, containing quotes, semicolons, and other shell metachars for devasting results. The current GetSafePath method only escapes space and backslash - and that is only applied to $#, not $@. There is thus no way currently to write a safe incrontab that monitors wildcards or directories. Here is part of the README from a package that would otherwise like to use incron:

You might wonder why we don't simply supply an acme incrontab as part
of the package with a wildcard, for example:

/var/lib/acme/certs/*.crt IN_MOVED_TO cp $@ /etc/pki/tls/certs

The answer is that incron-0.5.12 is insecure, and very nasty things can be
done by putting shell meta characters (including semicolon and quote!) in
filenames that then become part of a command run as root.

Proposed Solution

The problem is primarily due to using system() (or running /bin/sh) to execute commands. The flag shell=true would cause incron to use shell instead of execvp(). This would at least make it possible for the command that is run to sanitize its arguments - pushing the problem off to the user. The current behavior of always running shell is an incompatible change that previously secure incrontab scripts totally vulnerable to malicious filenames.

The other approach would be to more aggressively sanitize filenames in incron itself. However, that would reduce its flexibility. For instance, consider the following incrontab to remove nasty filenames created in a protected directory:

/var/lib/safedir/* IN_CREATE /usr/local/bin/rmgarbage $@

Where rmgarbage inspects the filename, and unlinks it if it has forbidden chars.

With this file saved as /etc/incron.d/10-locale.nopurge:

# /etc/locale.nopurge.head IN_MODIFY /etc/locale.nopurge.sh
/etc/locale.gen IN_MODIFY /etc/locale.nopurge.sh

I get this in my logs:

mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument
mai 07 07:16:14 [REDACTED] incrond[26352]: cannot create watch for system table 10-locale.nopurge: (22) Invalid argument

and the memory usage for incrond spikes to something around 15%, which is about the same as the memory usage of Firefox (that is, about 500M).

Even disregarding the lack of support for comments (#4), this behaviour is unacceptable.

... since it results in waiting for each child to finish immediately after it has started. This is likely to mean blocking and not processing any new events if the child happens to be long-running.

I was using 0.5.12 (before that checkout anyway) and getting lots of zombies, so I tried

icd-main.cpp
    case SIGCHLD:
+      while (waitpid((pid_t)(-1), 0, WNOHANG) > 0) {}

which has resulted in no more zombies.

Hello,

We have noticed an issuing using incron on a NFS mounted file system. I have noticed that incrond and the nfs-client.target start at the same time and if incrond starts before the nfs-client, nfs services are not monitored for file system changes and inotify then doesn't monitor the filesystem.

12:05:18] root@test-box-01
/etc/systemd/system# systemctl status nfs-client.target
● nfs-client.target - NFS client services
Loaded: loaded (/usr/lib/systemd/system/nfs-client.target; enabled; vendor preset: disabled)
Active: active since Fri 2018-05-25 12:21:25 AEST; 3 days ago

May 25 12:21:25 test-box-01.creditlink.com.au systemd[1]: Reached target NFS client services.
May 25 12:21:25 test-box-01.creditlink.com.au systemd[1]: Starting NFS client services.

● incrond.service - Inotify System Scheduler
Loaded: loaded (/usr/lib/systemd/system/incrond.service; enabled; vendor preset: disabled)
Active: active (running) since Fri 2018-05-25 12:21:25 AEST; 3 days ago
Main PID: 689 (incrond)
CGroup: /system.slice/incrond.service
└─689 /usr/sbin/incrond

May 25 12:21:25 test-box-01.creditlink.com.au systemd[1]: Starting Inotify System Scheduler...
May 25 12:21:25 test-box-01.creditlink.com.au incrond[677]: starting service (version 0.5.10, built on Sep 24 2014 19:02:26)
May 25 12:21:25 test-box-01.creditlink.com.au incrond[689]: loading system tables
May 25 12:21:25 test-box-01.creditlink.com.au incrond[689]: loading user tables
May 25 12:21:25 test-box-01.creditlink.com.au incrond[689]: loading table for user wasadmin
May 25 12:21:25 test-box-01.creditlink.com.au incrond[689]: ready to process filesystem events
May 25 12:21:25 test-box-01.creditlink.com.au systemd[1]: Started Inotify System Scheduler.

Version-Release number of selected component (if applicable):

nfs-utils-1.3.0-0.54.el7.x86_64
incron-0.5.10-8.el7.x86_64

Steps to Reproduce:
incrontab entry:

/import IN_CLOSE_WRITE /root/bin/test.sh $@/$#

Script contents
/root/bin# cat /root/bin/test.sh
#!/bin/bash
filename=$1
echo "$(date) Found File: $1" >> /tmp/test.junk 2>&1

Incron Running once loaded after NFS

[13:18:26] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk
[13:18:28] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk
[13:18:29] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk
[13:18:30] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk
[13:18:30] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk
[13:18:32] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk

Incron log entries:
2018-05-29T13:18:01.602113+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/test.junk)
2018-05-29T13:18:28.975097+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/test.junk)
2018-05-29T13:18:29.981485+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/test.junk)
2018-05-29T13:18:30.484573+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/test.junk)
2018-05-29T13:18:30.987448+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/test.junk)
2018-05-29T13:18:32.297748+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/test.junk)
2018-05-29T13:18:33.708373+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/test.junk)

Umount and remount NFS Share
[13:22:57] root@test-box-02
/root/bin# umount /import/

[13:23:06] root@test-box-02
/root/bin# mount /import/

Run test messages again
/root/bin# echo "This is a test file" > /import/test.junk
[13:23:38] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk
[13:23:39] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk

Log file not updated
2018-05-29T13:18:33.708373+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/test.junk)
2018-05-29T13:18:52.758378+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/)
2018-05-29T13:18:52.758589+10:00 test-box-02 incrond[28133]: (root) CMD (/root/bin/test.sh /import/)

Entries from 13:23:37,38,39 not included in file
/root/bin# cat /tmp/test.junk
Found File: /import/test.junk
Tue May 29 13:18:28 AEST 2018 Found File: /import/test.junk
Tue May 29 13:18:29 AEST 2018 Found File: /import/test.junk
Tue May 29 13:18:30 AEST 2018 Found File: /import/test.junk
Tue May 29 13:18:30 AEST 2018 Found File: /import/test.junk
Tue May 29 13:18:32 AEST 2018 Found File: /import/test.junk
Tue May 29 13:18:33 AEST 2018 Found File: /import/test.junk
Tue May 29 13:18:52 AEST 2018 Found File: /import/
Tue May 29 13:18:52 AEST 2018 Found File: /import/
[13:24:08] root@test-box-02

Restart incrond
[13:24:58] root@test-box-02
/root/bin# systemctl restart incrond

[13:25:20] root@test-box-02
/root/bin# systemctl status incrond
● incrond.service - Inotify System Scheduler
Loaded: loaded (/usr/lib/systemd/system/incrond.service; disabled; vendor preset: disabled)
Active: active (running) since Tue 2018-05-29 13:25:09 AEST; 13s ago
Process: 29263 ExecStart=/usr/sbin/incrond (code=exited, status=0/SUCCESS)
Main PID: 29264 (incrond)
CGroup: /system.slice/incrond.service
└─29264 /usr/sbin/incrond

2018-05-29T13:25:09.599421+10:00 test-box-02 incrond[28133]: stopping service
2018-05-29T13:25:09.608714+10:00 test-box-02 incrond[29263]: starting service (version 0.5.10, built on Sep 24 2014 19:02:26)
2018-05-29T13:25:09.613623+10:00 test-box-02 incrond[29264]: loading system tables
2018-05-29T13:25:09.613880+10:00 test-box-02 incrond[29264]: loading user tables
2018-05-29T13:25:09.614776+10:00 test-box-02 incrond[29264]: loading table for user spuser
2018-05-29T13:25:09.615332+10:00 test-box-02 incrond[29264]: loading table for user root
2018-05-29T13:25:09.617126+10:00 test-box-02 incrond[29264]: ready to process filesystem events

Send test messages:

[13:25:23] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk
[13:25:32] root@test-box-02
/root/bin# echo "This is a test file" > /import/test.junk

Log file
2018-05-29T13:25:32.045328+10:00 test-box-02 incrond[29264]: (root) CMD (/root/bin/test.sh /import/test.junk)
2018-05-29T13:25:33.552584+10:00 test-box-02 incrond[29264]: (root) CMD (/root/bin/test.sh /import/test.junk)

File has new entries:

Tue May 29 13:25:32 AEST 2018 Found File: /import/test.junk
Tue May 29 13:25:33 AEST 2018 Found File: /import/test.junk

I suspect that if there is dependency placed on incrond to wait for nfs-client this will probably go away.

Every time a program is executed due to an event , a zombie process is left in the system. I think it is quite easy to fix by adding something like:

int status;
waitpid(pid, &status, 0);

in the parent section of the fork at usertable.cpp

Sometimes it would be useful to watch on events in the filesystem just for certain file types (normal files, directories, symlinks etc.). Maybe with syntax something as "type=f[,b][,c][,d][,L][,p][,..]" tag in field, just as there are new tags loopable/recusive/dotdirs.

This bug report is a copy of https://bugs.debian.org/592691

[Karl O. Pinc]

Incron exhibits somewhat inconsistent behavior in that it tracks files by inode (I assume) but these files are specified by path in the incrontab. So, if you delete a file and re-create it, as some commonly used editors do as part of the editing process, the file is no longer tracked -- until incrond is restarted or (I assume) the incrontab file is modified at which point the (new) file is again tracked. This 'impedance mismatch' is a bit odd.

I assume this is the intended design. It is the behavior I observe.

If nothing else a note of this issue should be made in the documentation.

It would be nice if incron had a new symbol, say IN_TRACK_PATH, that keeps the tracking associated with the pathname given in the config file. I assume this could be done by monitoring the parent directory for changes and watching for the file name to come into existence, the name of the file to change, etc.

I would think that the desire to track changes to a file that exists in a particular filesystem location is rather common. Absent this feature it's up to the user to repeatedly script such things.

Note that such a change alters the meaning of existing symbols, e.g., changing the file name would be equivalent to deleting the file, etc. I don't know whether it makes sense to re-use the existing symbols in this new context or to come up with entirely new ones.

When executing commands for new files that arrive, there is no limit to the number of fork() calls.

Imagine the following scenario:

• A thousand files land up more or less at the same time on a watched directory

What happens:

• A thousand fork() calls will be called, resulting in a thousand new processes, which can easily jam the system

What should happen:

• incron should have an upper limit on the number of active processes it starts
• Can potentially be implemented with a queue and a thread/process pool

write an upstart script for the serivce command

The grammar of the config files is very fundamental and the parser is awefull and outdated. A prper parser woudl be good.

There are some vaguenesses in doc:

• Changelog mentions recursive directory watching, but TODO say that it is absent, and incrontab(5) (where it could be well described) mention it only marginally.
• Possibility to use shell patterns? regexps? in incrontab's watched path is nearly undocumented (but there is example).
• There is no documented syntax for the separator between items. In v0.5.10- was (IMHO) only one space allowed, now is in Changelog that may be tabs (one? sequence? can be mixed with space(s)?) also, but without clarification.

Originals:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=563700
http://bts.aiken.cz/view.php?id=449

incrontab(1) mangles comments in incrontab(5): it changes the first
word on every comment line to "0". For example, if I run incrontab
and create a file with the following comment lines:

Only put 1 space between fields 2 and 3! Additional whitespace will be

assumed to be part of field 3, causing the command to fail!

then incrontab -l shows that I have the following incrontab file:
#0 put 1 space between fields 2 and 3! Additional whitespace will be
#0 to be part of field 3, causing the command to fail!

I've tried this on CentOS 7.5, 7.6 and 6.10 for incron 0.5.12 and 0.5.10
It seems like incrond 0.5.12 is not properly stopping its forks and resulting in huge performance issues.

Lingering processes

I'm creating a simple file watcher for a directory that runs true on IN_CREATE. That's it.
My test creates 10 files and checks running processes.

incrond 0.5.10

Config

yum -y remove incron && http://packages.psychotic.ninja/7/base/x86_64/RPMS//incron-0.5.10-9.el7.psychotic.x86_64.rpm
rm -rf /var/tmp/test && mkdir -p /var/tmp/test
echo "/var/tmp/test IN_CREATE true" > /etc/incron.d/test
systemctl restart incrond
sleep 1
for i in `seq 1 10`; do touch /var/tmp/test/$i; done
ps aux | grep incron | grep -v grep

Output

[root@localhost ~]# ps aux | grep incron | grep -v grep
root     15992  0.8  0.1  12776   816 ?        Ss   14:23   0:07 /usr/sbin/incrond

incrond 0.5.12

Config

yum -y remove incron && yum -y install http://packages.psychotic.ninja/7/base/x86_64/RPMS//incron-0.5.12-3.el7.psychotic.x86_64.rpm
rm -rf /var/tmp/test && mkdir -p /var/tmp/test
echo "/var/tmp/test IN_CREATE true" > /etc/incron.d/test
systemctl restart incrond
sleep 1
for i in `seq 1 10`; do touch /var/tmp/test/$i; done
ps aux | grep incron | grep -v grep

Output

[root@localhost ~]# ps aux | grep incron | grep -v grep
root     15149  0.0  0.2  12788  1008 ?        Ss   13:08   0:00 /usr/sbin/incrond
root     15160  0.0  0.1  12788   664 ?        S    13:16   0:00 /usr/sbin/incrond
root     15163  0.0  0.0  12788   224 ?        S    13:16   0:00 /usr/sbin/incrond
root     15166  0.0  0.0  12788   224 ?        S    13:16   0:00 /usr/sbin/incrond
root     15169  0.0  0.0  12788   224 ?        S    13:16   0:00 /usr/sbin/incrond
root     15171  0.0  0.0  12788   424 ?        S    13:16   0:00 /usr/sbin/incrond
root     15174  0.0  0.0  12788   424 ?        S    13:16   0:00 /usr/sbin/incrond
root     15178  0.0  0.0  12788   224 ?        S    13:16   0:00 /usr/sbin/incrond
root     15181  0.0  0.1  12788   668 ?        S    13:16   0:00 /usr/sbin/incrond
root     15184  0.0  0.0  12788   224 ?        S    13:16   0:00 /usr/sbin/incrond
root     15187  0.0  0.0  12788   224 ?        S    13:16   0:00 /usr/sbin/incrond

Performance

Test

We're running a simple test that creates 10,000 files with the above configuration.
Run the following

mkdir -p /var/tmp/test; rm -rf /var/tmp/test/*; for i in `seq 1 10000`; do touch /var/tmp/test/$i; sleep 0.01; done

Run top

incrond 0.5.10

top - 14:30:07 up 9 days,  1:21,  2 users,  load average: 0.71, 0.57, 0.32
Tasks: 111 total,   1 running, 110 sleeping,   0 stopped,   0 zombie

incrond 0.5.12

(I had to stop this after 2,000)

top - 14:44:16 up 9 days,  1:35,  2 users,  load average: 132.00, 31.32, 10.51
Tasks: 1988 total,   1 running, 1987 sleeping,   0 stopped,   0 zombie

I have a FUSE filesystem that does not have allow_root set, so only a normal user can access it. In particular, root can not monitor it. (This is Keybase's kbfs.) Is it possible to run incrond as a normal user?

Hi,

The default values for these new options added recently break backward compatibility. For people using incron installed with their favorite package manager, it could lead to unexpected behaviour. Especially with the recursion option which seems to be highly experimental.

What do you think about using default options which preserve backward compatibility?

M.

This bug report is a copy of https://bugs.debian.org/606301

[Peter Eisentraut]

I have EDITOR='nano -t'. With that setting I get

$ incrontab -e
editor finished with error: Inappropriate ioctl for device

When setting EDITOR='nano' it works.

Note that that EDITOR setting (or similar ones) work correctly with dozens of other packages that use the EDITOR variable.

On several RHEL and CentOS 7 systems we just updated from 0.5.10 to 0.5.12 via the package from the EPEL repository. Since then we have started getting a large number of defunct processes that are children of the incron daemon. Each and every time a particular script runs a "zombie" process is left with the parent PID pointing to the incron daemon.
The incrontab entry in question is as follows:

/oracle/hbanpr/jobs/output IN_CLOSE_WRITE,recursive=false /home/oracle/bin/cp_to_volshare.sh $@/$#

I added "recursive=false" to the line after reading some recent posts on the network. When I look at the zombie processes in the /proc filesystem they have no open files. The script itself is pretty simple, it merely copies the file triggering the event to another location and it works just fine if I invoke it from the command line.
Short of restarting incrond periodically to flush out the defunct processes, is there something else I can do to resolve this?

Would it be possible to make incron print the stdout and stderr of a command together with it's stdout and stderr as well? This could be very helpful when debugging scripts called by incrond.

Additionally, I've noticed that if a script given in an incron table is not executable, incrond doesn't even yield out any indication of it what so ever. Today I've spent 3 hours trying to figure out why my script doesn't work before I realized it wasn't even executable.

I hope this will be easily implementable,
Thanks for creating this awesome software.

Original:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=456821

The man page doesn't say it, but the three fields in a line of an
incrontab file have to be separated by any number of spaces. It would
be convenient to allow tabs to be used as separators too (and document
that in the man page).

Thanks,
A.S.

I use incrond to monitor some website folders & the incron.d files have 2000-3500 directories monitored for each domain. All of them start with no error messages except the largest which prints to syslog almost 200 times:

cannot create watch for system table xxxxxxxx: (28) No space left on device

from the number of errors in syslog & the number of directories monitored the error messages seem to be for lines above 3175.

I normally mount /tmp as a tmpfs & tried running incrond with just a normal /tmp but it makes no difference. The root filesystem is btrfs without a separate /var.

Is this a hard limit of 3175 for monitoring that I can patch in the sources ?

IMO it would be very helpful if incron accept only certain file names - perhaps names with '.conf' suffix, as is usual with files in X11/xorg.conf.d, dovecot/conf.d, exports.d, modprobe.d, php.d, httpd/conf.d, rsyslog.d, sane.d, sysctl.d, tmpfiles.d, udev/rules.d and others.

I can consistently crash incrond 0.5.12 with a single mkdir command.

incrontab:

/tmp/i IN_CREATE echo $@/$# $%

Journal output upon mkdir /tmp/i/del:

incrond[13604]: PATH (/tmp/i) FILE (del) EVENT (IN_CREATE,IN_ISDIR)
systemd[1]: incrond.service: Main process exited, code=dumped, status=11/SEGV
systemd[1]: incrond.service: Unit entered failed state.
systemd[1]: incrond.service: Failed with result 'core-dump'.

Backtrace:

(gdb) bt
#0  0x00007f07242bc3e8 in memchr () from /usr/lib/libc.so.6
#1  0x00007f07249138aa in std::char_traits<char>::find (__a=<synthetic pointer>: <optimized out>, __n=<optimized out>,
    __s=<optimized out>) at /build/gcc-multilib/src/gcc-build/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/char_traits.h:274
#2  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::find (this=<optimized out>, __c=<optimized out>,
    __pos=<optimized out>) at /build/gcc-multilib/src/gcc-build/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:1209
#3  0x000000000040fd71 in ?? ()
#4  0x000000000041060e in ?? ()
#5  0x0000000000404412 in ?? ()
#6  0x00007f0724259291 in __libc_start_main () from /usr/lib/libc.so.6
#7  0x0000000000405249 in ?? ()

Observations:

• File creation (touch) does not cause the issue. Only directories;
• When leaving out the $@, the command runs just fine (/tmp/i IN_CREATE echo /$# $%)
• I confirmed the behaviour on tmpfs and ext4.

Hi

I've found some security issues in incron. Is there a security contact for this project?

I've tried contacting the email address from the official website but no replies.

Thanks
Dawid Golunski

This is my "incrontab -e":
/home/< User >/filename IN_MODIFY /home//th.sh $#

This is my th.sh:
OUTPUT=$(xclip -o); curl "< stuff that's irrelevant to the post >&message='${OUTPUT}'"

The issue is that if I don't define the OUTPUT variable in the th.sh and just end with =message=words", then it works, but if I use it with the variable ='${OUTPUT}' then the result (who I'm curl to) just becomes an " when it should be what the OUTPUT variable is, which is not ".

If I run the th.sh in the terminal it works just fine (OUTPUT variable get used), but strangely not when I use incrontab to execute the th.sh.

Hope thats english, might just be that I'm just using incrontab incorrectly, appreciate any help.

CentOS Linux release 7.6.1810 (Core)
incron-0.5.12-6.el7.x86_64

Reading the documentation, it says that dotfiles/dotdirectories should be ignored when using "dotdirs=false". I have validated that dotdirectories don't trigger, but dotfiles do.

I have the following entry in /etc/incrond.d/

/some/dir IN_DELETE,IN_CLOSE_WRITE,recursive=false,dotdirs=false /usr/bin/createrepo -v --workers=8 --update /some/dir

I create a file in /some/dir:

touch test

I then get a loop that occurs because of a dotfile that is being generated as part of the command above:

Apr  9 11:08:49 myhostname incrond[165043]: ready to process filesystem events
Apr  9 11:08:56 myhostname incrond[165043]: PATH (/some/dir) FILE (test) EVENT (IN_CLOSE_WRITE)
Apr  9 11:08:56 myhostname incrond[165043]: (system::common.conf) CMD (/usr/bin/createrepo -v --workers=8 --update /some/dir)
Apr  9 11:08:57 myhostname incrond[165043]: PATH (/some/dir) FILE (.olddata) EVENT (IN_DELETE,IN_ISDIR)
Apr  9 11:08:57 myhostname incrond[165043]: (system::common.conf) CMD (/usr/bin/createrepo -v --workers=8 --update /some/dir)
Apr  9 11:08:59 myhostname incrond[165043]: PATH (/some/dir) FILE (.olddata) EVENT (IN_DELETE,IN_ISDIR)
Apr  9 11:08:59 myhostname incrond[165043]: (system::common.conf) CMD (/usr/bin/createrepo -v --workers=8 --update /some/dir)

I also tested this by creating a dotfile manually and it also triggered:

touch .testing123

Apr  9 11:15:19 myhostname incrond[165778]: PATH (/some/dir) FILE (.testing123) EVENT (IN_CLOSE_WRITE)
Apr  9 11:15:19 myhostname incrond[165778]: (system::common.conf) CMD (/usr/bin/createrepo -v --workers=8 --update /some/dir)
Apr  9 11:15:20 myhostname incrond[165778]: PATH (/some/dir) FILE (.olddata) EVENT (IN_DELETE,IN_ISDIR)
Apr  9 11:15:20 myhostname incrond[165778]: (system::common.conf) CMD (/usr/bin/createrepo -v --workers=8 --update /some/dir)
Apr  9 11:15:22 myhostname incrond[165778]: PATH (/some/dir) FILE (.olddata) EVENT (IN_DELETE,IN_ISDIR)
Apr  9 11:15:22 myhostname incrond[165778]: (system::common.conf) CMD (/usr/bin/createrepo -v --workers=8 --update /some/dir)
Apr  9 11:15:24 myhostname incrond[165778]: PATH (/some/dir) FILE (.olddata) EVENT (IN_DELETE,IN_ISDIR)
Apr  9 11:15:24 myhostname incrond[165778]: (system::common.conf) CMD (/usr/bin/createrepo -v --workers=8 --update /some/dir)

Previous version of incron I had on this system did not do this:
incron-0.5.10-8.el7.x86_64

Originals:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=503973
http://bts.aiken.cz/view.php?id=413

The following patch enables several warning flags that I routinely use.
I tried "-pedantic" but it can't compile with that flag. It would be
good if the code could be cleaned up so that it can compile with
-pedantic too.

diff -ru incron-0.5.7.b/Makefile incron-0.5.7/Makefile
--- incron-0.5.7.b/Makefile 2008-10-30 11:37:40.000000000 +1100
+++ incron-0.5.7/Makefile 2008-10-30 11:40:43.000000000 +1100
@@ -14,7 +14,7 @@

OPTIMIZE = -O2
DEBUG = -g0
-WARNINGS = -Wall
+WARNINGS = -Wall -W -Wshadow -Wpointer-arith -Wwrite-strings -ffor-scope
CXXAUX = -pipe

CXXFLAGS = $(OPTIMIZE) $(DEBUG) $(WARNINGS) $(CXXAUX)
diff -ru incron-0.5.7.b/incrontab.cpp incron-0.5.7/incrontab.cpp
--- incron-0.5.7.b/incrontab.cpp 2007-09-05 01:48:33.000000000 +1000
+++ incron-0.5.7/incrontab.cpp 2008-10-30 11:39:22.000000000 +1100
@@ -112,9 +112,9 @@
rEntry.m_uMask = (uint32_t) u;
}
else {

• StringTokenizer tok(s2);
• while (tok.HasMoreTokens()) {

•  std::string s(tok.GetNextToken());
  

• StringTokenizer tok2(s2);
• while (tok2.HasMoreTokens()) {

•  std::string s(tok2.GetNextToken());
  

  if (s == "IN_NO_LOOP")
  rEntry.m_fNoLoop = true;
  else

Hello,

when i used the following line in the incrontab:
/etc IN_DELETE,IN_CLOSE_WRITE /script/incronfilter.sh $@ $# $%

The $# will be set to the Correct filename when i create a file.
Apr 18 09:41:56 test incrond[3351]: PATH (/etc) FILE (abc123) EVENT (IN_CLOSE_WRITE)
Apr 18 09:41:56 test incrond[3351]: (root) CMD (/script/incronfilter.sh /etc abc123 IN_CLOSE_WRITE)

But when i edit the file again there will be just a Number instead of the Filename:
Apr 18 09:48:06 test incrond[3351]: PATH (/etc) FILE (4913) EVENT (IN_CLOSE_WRITE)
Apr 18 09:48:06 test incrond[3351]: (root) CMD (/script/incronfilter.sh /etc 4913 IN_CLOSE_WRITE)

Sometimes it will show the filename and sometimes the Number 4913.

I am using:

RHEL7 7.6 and incron-0.5.12-11.el7.x86_64 from the epel-repository.

Can anyone explain me this behavior or is anyone else faceing this?

Regards,
Finn

Watching a directory recursively is not nativlely supported by inotify and so it is not in incron. Even though is is hightly requested, and actually not too complicated to implement.

A possible python extension is here: https://github.com/nguyent/incron-recursive .

In 2013 the Author tried to get funding to implement this feature, whcih brought him 0 cents. That's one of the reasons why he abondenned the project.

Another alternative seems to be https://github.com/gregghz/Watcher .

Obeserving directories recursively, must be added to incron.

About every time I try to use recursive check:

Events: IN_CLOSE_WRITE,IN_CREATE,IN_DELETE
2015-12-03T19:33:42.939886+00:00 ed-v-pst incrond[46357]: system table hierayaml20151203-48648-1o3n0go created, loading
2015-12-03T19:33:42.940234+00:00 ed-v-pst incrond[47013]: system table hierayaml changed, reloading
2015-12-03T19:33:42.940568+00:00 ed-v-pst incrond[46289]: PATH (/etc/puppet/hiera.yaml) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:42.940794+00:00 ed-v-pst incrond[46289]: (system::hierayaml) CMD (touch /etc/puppet/rack/tmp/restart.txt)
2015-12-03T19:33:43.030122+00:00 ed-v-pst incrond[46534]: PATH (/etc/puppet/modules/acl/acceptance/scripts) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.030601+00:00 ed-v-pst incrond[46199]: PATH (/etc/puppet/modules/acl/acceptance/tests) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.068804+00:00 ed-v-pst incrond[47013]: PATH (/etc/puppet/modules) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.083613+00:00 ed-v-pst incrond[46534]: (system::hieradata) CMD (touch /etc/puppet/rack/tmp/restart.txt)
2015-12-03T19:33:43.083861+00:00 ed-v-pst incrond[46199]: (system::hieradata) CMD (touch /etc/puppet/rack/tmp/restart.txt)
2015-12-03T19:33:43.084105+00:00 ed-v-pst incrond[47013]: (system::hieradata) CMD (touch /etc/puppet/rack/tmp/restart.txt)
2015-12-03T19:33:43.084367+00:00 ed-v-pst incrond[46507]: PATH (/etc/puppet/modules/acl/acceptance) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.084676+00:00 ed-v-pst incrond[46507]: (system::hieradata) CMD (touch /etc/puppet/rack/tmp/restart.txt)
2015-12-03T19:33:43.084896+00:00 ed-v-pst incrond[46507]: PATH (/etc/puppet/modules/acl/acceptance/tests/access_rights_directory/mask_specific) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.085121+00:00 ed-v-pst incrond[46507]: (system::hieradata) CMD (touch /etc/puppet/rack/tmp/restart.txt)
2015-12-03T19:33:43.085335+00:00 ed-v-pst incrond[46507]: PATH (/etc/puppet/modules/acl/acceptance/tests/access_rights_file) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.085552+00:00 ed-v-pst incrond[46507]: (system::hieradata) CMD (touch /etc/puppet/rack/tmp/restart.txt)
2015-12-03T19:33:43.085772+00:00 ed-v-pst incrond[46507]: PATH (/etc/puppet/modules/acl/acceptance/tests/access_rights_file/mask_specific) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.086018+00:00 ed-v-pst incrond[46421]: PATH (/etc/puppet/modules/acl/acceptance/tests/inheritance) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.094616+00:00 ed-v-pst incrond[46454]: *** unhandled exception occurred ***
2015-12-03T19:33:43.094852+00:00 ed-v-pst incrond[46454]:   void Inotify::Remove(InotifyWatch*): removing watch failed
2015-12-03T19:33:43.095102+00:00 ed-v-pst incrond[46403]: *** unhandled exception occurred ***
2015-12-03T19:33:43.095345+00:00 ed-v-pst incrond[46403]:   void Inotify::Remove(InotifyWatch*): removing watch failed
2015-12-03T19:33:43.095572+00:00 ed-v-pst incrond[46539]: PATH (/etc/puppet/modules/postfix/tests) FILE () EVENT (IN_IGNORED)
2015-12-03T19:33:43.095872+00:00 ed-v-pst incrond[46403]:   error: (22) Invalid argument

Then resources ends and we have

2015-12-03T19:38:07.364494+00:00 ed-v-pst incrond[44293]: cannot fork process: Cannot allocate memory
2015-12-03T19:38:07.364571+00:00 ed-v-pst incrond[44293]: PATH (/etc/puppet/modules/postgresql/lib) FILE () EVENT (IN_IGNORED)
2015-12-03T19:38:07.364638+00:00 ed-v-pst incrond[44293]: (system::hieradata) CMD (touch /etc/puppet/rack/tmp/restart.txt)
2015-12-03T19:38:07.364705+00:00 ed-v-pst incrond[29948]: *** unhandled exception occurred ***
2015-12-03T19:38:07.364787+00:00 ed-v-pst incrond[29948]:   void Inotify::Remove(InotifyWatch*): removing watch failed
2015-12-03T19:38:07.364859+00:00 ed-v-pst incrond[29948]:   error: (22) Invalid argument
2015-12-03T19:38:07.365343+00:00 ed-v-pst incrond[29948]: stopping service
2015-12-03T19:38:07.365415+00:00 ed-v-pst incrond[46971]: cannot fork process: Cannot allocate memory

# killall -9 incrond
-bash: fork: Cannot allocate memory

Update: have issues with one file watch only as well

/etc/puppet/.git/refs/heads/master IN_MODIFY touch /etc/puppet/rack/tmp/restart.txt

2015-12-03T20:25:10.814489+00:00 ed-v-pst incrond[57428]: PATH (/etc/puppet/.git/refs/heads/master) FILE () EVENT (IN_IGNORED)
2015-12-03T20:25:10.814956+00:00 ed-v-pst incrond[57428]: (system::master) CMD (touch /etc/puppet/rack/tmp/restart.txt)

and after this it fork one more process and does not do anything more (next events ignored)

OS: CentOS7

This bug report is a copy of https://bugs.debian.org/418852

[Patrick Schoenfeld]

The current system table is not able to have a username in it, as which the specified command should run. I even think this is a must, as incron "borrows" its name from cron, which is able to do so. Also it is a must in my opinion as the systemwide directory could (and should) be used with packages, that like to install incron entries in the future.

This bug report is a copy of https://bugs.debian.org/592692

[Karl O. Pinc]

Root, via /etc/incron.d/foo, received an IN_IGNORED event when monitoring file foo when emacs (I believe) deleted foo~ in a second editing session after, in an initial editing session, changing the name of foo to foo~ and leaving it as a backup file.

The identical incrontab entry in the user's incrontab

/home/kop/tmp/incron/foo IN_MODIFY,IN_ATTRIB,IN_CLOSE_WRITE logger -t rootincrontab "Received event $%"

received no such event. (AFAICT)

In any case IN_IGNORED is not documented in the incrontab(5) man page.