fanotify_watch's Introduction

fanotify_watch

This tool allows you watch filesystem events using Linux fanotify(7) API. It has a Mac brother http://github.com/proger/fsevent_watch.

This is a fork of Canonical's tool fatrace: https://launchpad.net/fatrace

The tool differs from the original in the following ways:

removed power-usage-report
flags -s and -o are removed as redundant
the tool does not read process names on every event by default (see -n option)
output buffer is flushed after processing each event buffer
FAN_ACCESS-like events are ignored (see caveats)

Awesomeness

the output is cute and parseable
as usual, the tool is composable enough to be used to even develop itself


% sudo ./fanotify_watch -c | egrep --line-buffered "$PWD.*\.[ch]$" | tee /dev/stderr | xargs -t -n1 -I% make
6445    CW  /tank/proger/fanotify_watch/fanotify_watch.c
make
cc -O2 -g -Wall -Wextra -Werror   -c -o fanotify_watch.o fanotify_watch.c
cc  -o fanotify_watch fanotify_watch.o

Caveats

fanotify(7) does not support tracking file deletion/renames
fanotify_watch primarily tracks FAN_CLOSE_WRITE (writable file closed) that signals for very probable file write event
- note that some tools may write the file under a different name and then rename it, this may go unnoticed
as of Linux 3.10 fanotify(7) needs you to be root (hence sudo)
- you can use suid binaries at your own risk though
fanotify(7) does not work on nfs and sshfs mounts (at least when i tested)
GPL-3, sorry

fanotify_watch's People

Contributors

Stargazers

Watchers

fanotify_watch's Issues

please add the ability to specify listen directory

This will helps to allow watching upper or other from start directory.

getopt_long doesn't match the actual accepted flags

./fanotify_watch -n
./fanotify_watch: invalid option -- 'n'

c = getopt_long (argc, argv, "co:s:tp:h", long_options, NULL);

was probably copied pasted from different code.

events from linked directories are not coming

This cause malfunction in Erlang releases.

error: implicit declaration of function ‘major’

Under Fedora 35:

cc -O2 -g -Wall -Wextra -Werror   -c -o fanotify_watch.o fanotify_watch.c
fanotify_watch.c: In function ‘print_event’:
fanotify_watch.c:124:19: error: implicit declaration of function ‘major’ [-Werror=implicit-function-declaration]
  124 |                   major (st.st_dev), minor (st.st_dev), st.st_ino);
      |                   ^~~~~
fanotify_watch.c:124:38: error: implicit declaration of function ‘minor’ [-Werror=implicit-function-declaration]
  124 |                   major (st.st_dev), minor (st.st_dev), st.st_ino);
      |                                      ^~~~~
cc1: all warnings being treated as errors
make: *** [<builtin>: fanotify_watch.o] Error 1

This could be fixed by