I'm trying to monitor my /tmp folder for changes using inotifywatch:sudo inotifywatch -v -r /tmpAfter creating couple of files (touch /tmp/test-1  /tmp/test-2), I'm terminating inotifywatch (by Ctrl-C which shows me the following statistics:Establishing watches...Setting up watch(es) on /tmpOK, /tmp is now being watched.Total of 39 watches.Finished establishing watches, now collecting statistics.total  attrib  close_write  open  create  filename8      2       2            2     2       /tmp/The output only prints the statistics, but not the files I expected (as in here or here). I tried different types of access (via cat, mktemp, etc.), but it's the same thing.Did I miss something?It's because I'm on VPS and something has been restricted?OS: Debian 7.3 (inotify-tools) on VPS
Why doesn't inotifywatch detect changes on added files?
files;recursive;inotify
This is due to the way you're using inotifywatch, and the way the tool itself works. When you run inotifywatch -r /tmp, you start watching /tmp and all the files that are already in it. When you create a file inside /tmp, the directory metadata is updated to contain the new file's inode number, which means that the change happens on /tmp, not /tmp/test-1. Additionally, since /tmp/test-1 wasn't there when inotifywatch started, there is no inotify watch placed on it. It means that any event which occurs on a file created after the watches have been placed will not be detected. You might understand it better if you see it yourself:$ inotifywatch -rv /tmp &Total of n watches.$ cat /sys/kernel/debug/tracing/trace | grep inotifywatch | wc -lnIf you have enabled the tracing mechanism on inotify_add_watch(2), the last command will give you the number of watches set up by inotifywatch. This number should the same as the one given by inotifywatch itself. Now, create a file inside /tmp and check again:$ inotifywatch -rv /tmp &Total of n watches.$ touch /tmp/test1.txt$ cat /sys/kernel/debug/tracing/trace | grep inotifywatch | wc -lnThe number won't have increased, which means the new file isn't watched. Note that the behaviour is different if you create a directory instead :$ inotifywatch -rv /tmp &Total of n watches.$ mkdir /tmp/test1$ cat /sys/kernel/debug/tracing/trace | grep inotifywatch | wc -ln + 1This is due to the way the -r switch behaves:-r, --recursive: [...] If new directories are created within watched directories they will automatically be watched.Edit: I got a little confused between your two examples, but in the first case, the watches are correctly placed because the user calls inotifywatch on ~/* (which is expanded, see don_crissti's comment here). The home directory is also watched because ~/.* contains ~/.. Theoretically, it should also contain ~/.., which, combined with the -r switch, should result in watching the whole system.However, it is possible to get the name of the file triggering a create event in a watched directory, yet I'm guessing inotifywatch does not retrieve this information (it is saved a little deeper than the directory name). inotify-tools provides another tool, called inotifywait, which can behave pretty much like inotify-watch, and provides more output options (including %f, which is what you're looking for here) :inotifywait -m --format %e %f /tmpFrom the man page:--format <fmt> Output in a user-specified format, using printf-like syntax. [...] The following conversions are supported:%f: when an event occurs within a directory, this will be replaced with the name of the file which caused the event to occur. %e: replaced with the Event(s) which occurred, comma-separated.Besides, the -m option (monitor) will keep inotifywait running after the first event, which will reproduce a behaviour quite similar to inotifywatch's.