We have two services, one downloads files from the internet to /tmp/myfolder, the other shuffels them from /tmp/myfolder to a mounted drive. Now since said folder is usually empty (as the files are just "passing through") I have no handle on files. Is there still a way to check when the last file has been written to /tmp/myfolder OR when the last file has been deleted from that folder?

If there's such a command it would be helpful for quick first sanity checks if our systems are up and running properly.

2 Answers 2


The last modification time of a directory is updated whenever its contents change, so adding or removing a file in a directory can be seen even after the file is gone by looking at the directory’s modification time:

stat --format=%y /tmp/myfolder
  • Oh then I got it twisted. But am I correct in that only the immediate parent folder is updated, but 2n generation+ parente won't change their last modified date?
    – glades
    Commented Jan 31 at 13:26
  • Yes, only the immediate parent changes. Commented Jan 31 at 13:32
  • Ok. I just check and it doesn't seem to work correctly on our system. It appears to show only the creation date as "last changed" . We use RHEL 9.1 and xfs file system, could that make a difference?
    – glades
    Commented Jan 31 at 13:48
  • Well, the ctime (last change time, not creation time) should be updated too. I haven’t checked the specifics on XFS, but POSIX requires updates to the last modification time. See File Times Update for the general rules, and for example the specification for unlink: “Upon successful completion, unlink() shall mark for update the last data modification and last file status change timestamps of the parent directory.” Commented Jan 31 at 14:05
  • Oh ok it does seem to work now. Maybe I was looking at the wrong folder..
    – glades
    Commented Jan 31 at 14:28

That would be a job for the inotify system interface, which you can use to subscribe to changes in a directory. With pyinotify and others there are useful scripting frontends for it. If you can't be notified, you'd have to poll the stat of the directory -- see Stephen's answer -- and that doesn't sound good for high-frequency checking.

In all honesty, though, this sounds like a software design problem to me, though, which you'd solve differently. You need proper logging, and monitoring of that, not to watch a folder for changes!

  • It's sure not optimal and we'll in time get rid of it (I hope). Thanks for the answer.
    – glades
    Commented Jan 31 at 13:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .