The inotify is a Linux kernel sybsystem for notifying user-space applications of filesystem changes. I always thought this exceptionally handy utility was under-appreciated or at least underutilized.

I am not planning on going through the many features of inotify, but instead will provide a couple of practical examples of how it can be used in your daily sysadmin work.

Recently I’ve ran into an issue when an application configuration file was being modified by people who can’t avoid typos to save their lives. Since they were unlikely to get better at typing and I couldn’t watch them around the clock, inotify was the solution.

If you don’t have it installed already, the process is quick:

The script below will use inotifywait to keep an eye on /etc/smb/smb.conf file. If that file changes, the script will undo the changes by restoring /etc/samba/.smb.conf_lastgood and then it reload Samba.

As you can see, just about any change to the file would trigger a response. You can run this script with nohup or & disown. Alternatively, you can have it started with the system (say, by adding it to Samba startup, which would make perfect sense here). Here’s an example of how to start this script with nohup:

This will continue to run until the next reboot. To start this process at boot time (but after Samba daemon), you can create an init configuration file in /etc/init/inotifywait.conf that would look something like this:

Then you can start it once manually and check the status to make sure everything worked as expected:

Similar to the previous example, the script below would monitor changes to SSHd configuration and recover the specified version of sshd_config file from etckeeper (you can read more about etckeeper here).

I commonly use inotify to trigger rsync when source filesystem content changes. What folks don’t always realize is that inotify can also be used to monitor special system files, such as those in /proc and /dev and this can be tremendously useful.

Here’s a basic example of being notified when a specified process (sleep 30 in this case) has exited: