I want to be notified when a specific filename is created. I'm looking at inotify. The IN_CREATE flag is available for monitoring a directory for any changes within it, but I'd prefer not to monitor the entire directory since there may be a good deal of activity in that directory besides the file I'm interested in. Can this be done?

  • 3
    I'm guessing the answer is 'no'. At least not with inotify. If you can control the location of the file, you're better off creating a special directory just for it, so you can monitor the directory without being woken up by distractions. If you can't control the location, you're faced with either comparing the returned 'name' field against the (relative) name of your file, or else calling something like access with F_OK to see if it exists yet. Sep 5, 2014 at 18:42

1 Answer 1


You cannot have the kernel only inform you of a change to a certain path. The reasons are a bit subtle:

  • In Linux, a file object exists independently of any name(s) it may have. Files' names are actually attributes of their containing directory, and a single file may be called by multiple names (see, hardlinking).

  • The kernel has to have something to attach inotify objects to; it cannot attach an object to a pathname since a pathname isn't a real filesystem object; you have to attach to the parent directory or the file that path describes. But you can't attach to the file, because you're watching to see if a file with a given name is created, not changes to a given file.

Theoretically, the kernel could implement an API that allows you to select events for a given pathname when adding a watch to a directory, much in the same way it allows you to select types of events. This would bloat the API, and the kernel would in the end be processing the same data and doing the same string comparison you would be doing in userspace.

Is there a noticeable performance hit to placing a watch on a very active directory? I'm not sure how active you mean; tens of files a second, hundreds, millions?

In any case, I would avoid access: it's always going to be racey. A file could be created and removed between calls to access, and calling access in a very tight loop is going to be slow, and is the kind of problem inotify was designed to solve.

  • 1
    If I can't be informed of "a change to a certain path", how does inotify work at all? Are you perhaps referring to file paths specifically but not directory paths? Sep 26, 2016 at 20:25
  • Also, the advantage of doing the check in the kernel rather than userspace is if there are multiple processes monitoring the directory. Instead of context switching them all in unnecessarily and having them all do a comparison you could just switch in the process that actually cares about the file path in question. Sep 26, 2016 at 20:36
  • I meant that when monitoring a directory (which obviously is given by a path), you can't tell the kernel to select only events with a given name (so yes, I'm referring to 'file' paths). I understand the theoretical benefits of not waking a bunch of processes, but I have to again ask if you tried using inotify, and if performance was an actual problem. Sep 26, 2016 at 22:27
  • 1
    Alternatively, if many processes are interested in certain events, you can have one process watching for filenames and sending out 'interesting' events over something like a UNIX socket to the processes actually interested in these events (as a sort of service). Sep 26, 2016 at 22:27
  • Performance problems can be extremely difficult to measure and diagnose. Rather than walk into brick walls, I prefer to adopt good programming practices in the first place, develop software that uses good design patterns, and avoid such situations. So no, I did not observe an issue. I anticipated a potential issue, and avoided use of inotify in this case due to potential of problems down the road. As a system software developer myself, I believe in providing robust mechanisms to help people avoid performance issues, which is the purpose of inotify. Sep 28, 2016 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .