CODEWITHSUNDEEP
linuxfanotify
Raydel Miranda
Raydel Miranda

Reputation: 14360

How to detect a file has been deleted

I am writing a program to monitor the file system. But I'm not able to detect when a file is deleted. I tried monitoring with FAN_MARK_ONLYDIR flag hoping fanotify rise some event when deleting a file in a monitored dir, no results.

It is even possible do this using fanotify? There are something to help me to do this?

Upvotes: 2

Views: 2477

Answers (2)

Jonathan
Jonathan

Reputation: 1419

You can do it when monitoring an entire filesystem by using:

fanotify_mark(fd, FAN_MARK_ADD | FAN_MARK_FILESYSTEM, FAN_DELETE, AT_FDCWD, "/")

Upvotes: 1

James Waldby - jwpat7
James Waldby - jwpat7

Reputation: 8711

According to a linuxquestions.org thread fanotify doesn't detect file replacement or deletion or subdirectory creation, renaming, or deletion. Also see baach.de discussion, which compares (or mentions) inotify, dnotify, fam, Fanotify, tripwire, Python-fuse, and llfuse (python) among other file or directory change monitors.

inotify supports IN_DELETE and IN_DELETE_SELF events and if you are working with a limited number of directories, rather than an entire filesystem, is practical to use.

Edit: Among inotify limitations or caveats mentioned in its webpage are the following:

inotify monitoring of directories is not recursive: to monitor subdirectories under a directory, additional watches must be created. This can take a significant amount time for large directory trees. ... If monitoring an entire directory subtree, and a new subdirectory is created in that tree, be aware that by the time you create a watch for the new subdirectory, new files may already have been created in the subdirectory. Therefore, you may want to scan the contents of the subdirectory immediately after adding the watch.

Upvotes: 3

Related Questions