Skip to content

inotifywait | Cheatsheet


inotifywait -q -m -r -e create /home/wuseman/emagnet/websites/nohide.space/ |
  while read -r directory event filename; do
    if [[ $event == "CREATE" ]]; then
      echo "File created: $directory$filename"
    fi
  done
inotifywait -q -m -r -e modify /path/to/directory |
  while read -r directory event filename; do
    if [[ $event == "MODIFY" ]]; then
      echo "File modified: $filename"
    fi
  done

Execute a command on file creation

inotifywait -q -m -r -e create /path/to/directory |
  while read -r directory event filename; do
    if [[ $event == "CREATE" ]]; then
      # Replace the following line with your desired command
      command_to_execute "$filename"
    fi
  done
inotifywait -q -m -r -e modify /path/to/directory |
  while read -r directory event filename; do
    if [[ $event == "MODIFY" ]]; then
      echo "File modified: $filename"
      echo "Timestamp: $(date +"%Y-%m-%d %H:%M:%S")"
    fi
  done

Perform an action on modified files

inotifywait -q -m -r -e modify /path/to/directory |
  while read -r directory event filename; do
    if [[ $event == "MODIFY" ]]; then
      # Replace the following line with your desired action
      echo "File modified: $filename"
      # Perform your action here
    fi
  done

Track specific file extensions

inotifywait -q -m -r -e modify --include '\.(txt|csv)$' /path/to/directory |
  while read -r directory event filename; do
    if [[ $event == "MODIFY" ]]; then
      echo "File modified: $filename"
    fi
  done
inotifywait -q -m -r -e modify --format '%f %s' /path/to/directory |
  while read -r filename size; do
    echo "File modified: $filename"
    echo "Size: $size bytes"
  done

Monitor file deletions

inotifywait -q -m -r -e delete /path/to/directory |
  while read -r directory event filename; do
    if [[ $event == "DELETE" ]]; then
      echo "File deleted: $filename"
    fi
  done

Track directory modifications

inotifywait -q -m -r -e modify --format '%w%f' /path/to/directory |
  while read -r modified_path; do
    echo "Directory modified: $modified_path"
  done

Exclude specific file types

inotifywait -q -m -r -e modify --exclude '\.(jpg|png)$' /path/to/directory |
  while read -r directory event filename; do
    if [[ $event == "MODIFY" ]]; then
      echo "File modified: $filename"
    fi
  done
inotifywait -q -m -r -e modify --format '%w%f %e' /path/to/directory |
  while read -r modified_path event_type; do
    echo "File modified: $modified_path"
    echo "Event type: $event_type"
  done
inotifywait -q -m -r -e modify --format '{"path": "%w%f", "event": "%e"}' /path/to/directory |
  while read -r json_data; do
    echo "Received event:"
    echo "$json_data"
    # Process the JSON data as needed
  done

Custom output format with additional information

inotifywait -q -m -r -e modify --format 'File: %w%f, Event: %e, Timestamp: %T' /path/to/directory |
  while read -r output; do
    echo "$output"
  done

To watch for created files and delete them if they are not of type .xt, you can use the following script

inotifywait -q -m -r -e create --format '%w%f' /path/to/directory |
while read -r created_file; do
  if [[ ! $created_file =~ \.xt$ ]]; then
    echo "Deleting file: $created_file"
    rm "$created_file"
  fi
done

Watch multiple events

inotifywait -q -m -r -e create,modify,delete /path/to/directory

This command monitors the specified directory (/path/to/directory) for multiple events (create, modify, and delete). The -e option is used to specify the events to watch, separated by commas.


Additional Options

Monitor a single directory (non-recursive)

inotifywait -q -m -e create /path/to/directory

Exclude specific files or directories

inotifywait -q -m -r --exclude '(^\.git|node_modules)' /path/to/directory

Only monitor specific file types

inotifywait -q -m -r --include '\.txt$' /path/to/directory

Display events as they occur

inotifywait -m -r -e create /path/to/directory
directory="/var/log"
cooldown=5

declare -A last_announce

inotifywait -m -e create -e modify -e delete --format "%e %f" "$directory" |
while read -r event filename
do
  current_time=$(date +%s)
  if [[ -z ${last_announce["$filename $event"]} || $(($current_time - ${last_announce["$filename $event"]})) -gt $cooldown ]]; then
    case "$event" in
      "CREATE")
        echo "Filename $filename was created."
        ;;
      "MODIFY")
        echo "Filename $filename was modified."
        ;;
      "DELETE")
        echo "Filename $filename was deleted."
        ;;
      *)
        echo "Filename $filename had event: $event"
        ;;
    esac
    last_announce["$filename $event"]=$current_time
  fi
done