I want to monitor a directory for new files, which will be created by another process. I plan to use incrod to do this.

I am not interested in reacting to changes in files, as the files should never be updated. Therefore the IN_CREATE event seems the sensible option to listen for. However, I am unsure, if I listen for that event, could I end up with an empty file (before the other process has written any information to it)? Should I use the IN_WRITE_CLOSE event instead?

You can observe which events are passed to your directory with inotifywait to check how does it behave when your process is running:

$ inotifywait -m . 
Setting up watches.
Watches established.

For example, after running touch file in same directory:

$ inotifywait -m .
Setting up watches.
Watches established.
./ CREATE file
./ OPEN file
./ ATTRIB file

Since there is delay between creating file and closing it, you'll have empty file after CREATE event, as you suspected. Observe events coming after running:

from time import sleep

with open("somefile", 'w') as somefile:

Therefore using CLOSE_WRITE event sounds reasonable.

Yes, IN_CREATE will (or at least may) give you an empty file. As the name indicates, the event is generated when a new file is created, and new files are created empty. It's possible that by the time the process that receives the notification gets around to reading the file, the file is not empty, but typically it won't have been fully written at that point.

To react to a completed file, IN_WRITE_CLOSE is what you need. Note that this event will fire up if the process creating the file crashes. To avoid that, a common strategy is to have the process write the file, then rename it (possibly moving it to a different directory). Your monitor would then listen to IN_MOVED_FROM.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.