If you got here because you searched for [linux file change notification] or a similar query, you are probably looking for inotify and may find the following links helpful: This page is about fschange, an alternative to inotify that I implemented before inotify became part of the mainline Linux kernel.

fschange – Linux File System Change Notification

dnotify and inotify are the current file change notification services in the Linux kernel. Unfortunately, they share a couple of shortcomings that make it difficult to use them for efficient (real-time) file system indexing under Linux. One of them is their unability to detect content-preserving file changes, i.e. write operations that only affect a tiny portion of a file. It is impossible to use inotify in order to determine what part of a file has actually been modified. A second problem is that you have to open every directory once before you can register for changes within that directory. This is very unconvenient, especially if you want to watch large file systems, as it requires a full scan of the file system.

fschange can be used to keep track of file changes by reading data from a proc file (/proc/fschange). When data is written to a file, fschange reports the exact interval that has been modified instead of just saying: "This file has been changed." It also offers partial support for file changes caused by mmap and tells you when a file system is mounted or unmounted. The latter is very useful for per-file-system indexing. fschange informs about changes to every part of the file system tree. It is not necessary to register for notification on a per-directory basis. Currently, only root may access this information.

The event types supported by fschange are: Please note that in all cases the filename/dirname is a full directory path, not just the last component of the full path. File changes caused by mmap are currently only detected for x86, IA64, and x86-64.

If you want to use fschange, download the stuff below, apply the patch to your kernel, run "make oldconfig", select "M" or "Y" when asked whether you want fschange support. Then rebuild and install your new kernel. Depending on whether you selected "M" or "Y", you will either see the /proc/fschange interface directly after your system has rebooted or after you have loaded the fschange kernel module.

Available resources: