inotifywait

Watch a specific file for events, exiting after the first one

$ inotifywait [path/to/file]

$ inotifywait [[-m|--monitor]] [path/to/file]

$ inotifywait [[-m|--monitor]] [[-r|--recursive]] [path/to/directory]

$ inotifywait [[-m|--monitor]] [[-r|--recursive]] --exclude "[regex]" [path/to/directory]

$ inotifywait [[-m|--monitor]] [[-t|--timeout]] [30] [path/to/file]

$ inotifywait [[-e|--event]] [modify] [path/to/file]

$ inotifywait [[-q|--quiet]] [path/to/file]

$ inotifywait [[-e|--event]] [access] [path/to/file] && [command]

inotifywait [options] path ...

-h, --help
    Display help text

-V, --version
    Show version information

-@file
    Exclude files listed in file from watching

--fromfile file
    Read watch paths from file or stdin

-o, --outfile file
    Append output to file instead of stdout

-d, --daemon
    Daemonize and write events to logfile

-e, --event event1 [event2 ...]
    Listen for specific events only (e.g., MODIFY, CREATE)

--exclude pattern
    Exclude paths matching shell glob pattern

--excludei pattern
    Case-insensitive path exclusion

--format string
    printf(1)-style output format (e.g., '%w%f %e')

-r, --recursive
    Watch directories recursively

-q, --quiet
    Suppress non-event messages

--include pattern
    Include only paths matching pattern

--includei pattern
    Case-insensitive inclusion

-m, --monitor
    Monitor continuously (default events: access,modify,close_*,delete)

--no-derivative
    Suppress derivative events like CLOSE after OPEN

-t, --timeout seconds
    Exit after seconds without events (0=infinite)

inotifywait is a command-line tool from the inotify-tools package that leverages Linux's inotify kernel subsystem to watch for filesystem events on specified files or directories.

It blocks execution until an event occurs, such as file creation, deletion, modification, or access, then prints details including the event name, watched path, and affected filename. This makes it ideal for shell scripts that need to react to file changes, like auto-reloading configs or triggering builds on source modifications.

Key features include recursive directory watching, filtering by specific events (e.g., MODIFY, DELETE), continuous monitoring mode, and customizable output formats. Events are reported in real-time with low overhead, but note that inotify only works on local filesystems and has kernel-enforced limits on watch descriptors per user.

Common use cases: watching log files for new entries, detecting USB drive insertions, or integrating into deployment pipelines. Output format is flexible via printf-style strings, aiding parsing in scripts.

Limited by kernel params like fs.inotify.max_user_watches (check with cat /proc/sys/fs/inotify/max_user_watches); no support for remote filesystems (NFS, etc.); events may coalesce under high load; root required for some system dirs.

ACCESS (read), MODIFY (write), ATTRIB (metadata change), CLOSE_WRITE/NOWRITE, OPEN, MOVED_FROM/TO (rename), CREATE, DELETE, DELETE_SELF.

inotifywait -m -r -e MODIFY,CREATE /dir
Watches /dir recursively for mods/creates, outputs continuously.

Developed by Rohan McGovern in 2005 as part of inotify-tools; introduced to support Linux kernel 2.6.13's inotify API (2005), replacing less efficient dnotify; widely used in tools like Dropbox, Git hooks.

inotifywatch(1), inotify(7), fswatch(1)