inotify detect a new file write without missing write_close event

Question

I want to watch a file created and written in a directory by a process. I don't have access to inotifywait tool, so I'm using just the inotify library calls. I start with IN_CREATE to monitor that the file was created. If the file of interest was created, then I drop in a CLOSE_WRITE event to be monitored. This scheme kind of works, except in the case that the file was already written and closed by the time my handler processes the IN_CREATE event, and I miss that write event.

What is the best way to work around this situation? I was considering using the stat function to use atim, mtim, but wasn't sure if that would have any gotchas. For example, I was planning to check if the current timestamp is greater than st_ctim, and if st_ctim is greater than st_atim. These two conditions would indicate that the file status changed (accessed and changed) before the current time.

Answer 1

First of all, I am not sure what do you mean, when stating: "If the file of interest was created, then I drop in a CLOSE_WRITE event to be monitored."

You can monitor IN_CREATE and IN_CLOSE_WRITE in the same poll, there is no need to switch between them. Once the event happen, you read the inotify_event structure from the inotify handler (returned from inotify_init()) and the field mask of it will tell you which event actually happened.

Second, there is a chance to miss the inotify event. It is clearly stated in the documentation. There are whole list of possible problems listed under "Limitations and caveats" title in the inotify(7).

It looks like you encountered the "queue overflowing". Yes, it is a real thing, which happens quite often on the busy system. Unfortunately, it is not possible to rectify. Only work around it. There are several ways to solve it, but cannot say more specific without better understanding of what are your needs.

In general, if you want to see an updated file as soon as it is updated - just scandir() the directory with sorting and/or filtering files by they mtime. In this scenario, the inotify would serve as a wake up call "something happened in the directory", upon receiving, you go into long-running process of checking all the updates. Once they are done - sleep in the poll(). In this case, you will ignore the events which happened between end of one poll() and start of the next one. But you will get all the updates in bulk.