CODEWITHSUNDEEP
linuxshellfilesystemsboost-filesystem
Anis_Stack
Anis_Stack

Reputation: 3452

how detect file change or remove in linux system

On a UNIX system, everything is a file; if something is not a file, it is a process. this is an advantage of linux file system, but a have a question here !!

how can I detect if a file has been created or changed or removed by user or program ?

I try to do this with inotify but doesn't work with kernel version 3.4 in openwrt distribution

thanks

Upvotes: 0

Views: 1515

Answers (1)

sestus
sestus

Reputation: 1927

Have you tried the stat command? If you cannot use inotify then you probably cannot use inotifywait as it uses the inotify interface.

You can get information about file creation and modification directly from its output.

The removed part (when a user or a program removes a file) cannot be accessed direclty. Unix provides the atime, mtime and ctime timestamps.

Atime is the time of the last access of contents. Ctime is the time of the last modification of the inode - metadata. Mtime is the time of the last modification of contents.

So no Removed time can directly be accesed. You can check if a file is deleted via the timestamps of the directory that the file was included.

Upvotes: 1

Related Questions