Inotify-tools

inotify事件监听监控统计工具, 能监视文件的inotify事件

inotify-tools包含两个工具

inotifywait: 滚动输出类似strace
inotifywatch: 统计类似perf

inotifywait

监控事件:

inotifywait -m -e [events] -r path

-m 持续监控 (默认只监控一次) -e 指定事件集 -r 子目录递归

事件

事件定义于内核 linux/include/uapi/linux/inotify.h

Events:
	access		file or directory contents were read
	modify		file or directory contents were written
	attrib		file or directory attributes changed
	close_write	file or directory closed, after being opened in
	           	writable mode
	close_nowrite	file or directory closed, after being opened in
	           	read-only mode
	close		file or directory closed, regardless of read/write mode
	open		file or directory opened
	moved_to	file or directory moved to watched directory
	moved_from	file or directory moved from watched directory
	move		file or directory moved to or from watched directory
	move_self		A watched file or directory was moved.
	create		file or directory created within watched directory
	delete		file or directory deleted within watched directory
	delete_self	file or directory was deleted
	unmount		file system containing file or directory unmounted
	```
## 使用事例
我需要找到kde的屏幕缩放的设置放在$HOME/.config的哪个文件 

我们先inotifywait 创建inotify监控实例 更改文件events为modify

```shell
inotifywait -r -m -e modify ~/.config

然后在kde的设置中改一次设置得到输出

Setting up watches.  Beware: since -r was given, this may take a while!
Watches established.
./ MODIFY kwinoutputconfig.json
./ MODIFY kwinrc.lock
./ MODIFY #16959842
./xsettingsd/ MODIFY xsettingsd.conf
./xsettingsd/ MODIFY xsettingsd.conf
./xsettingsd/ MODIFY xsettingsd.conf
./xsettingsd/ MODIFY xsettingsd.conf
./dconf/ MODIFY user.6EEMA3
./dconf/ MODIFY user.6EEMA3
./ MODIFY #16959815
./ MODIFY #16959815
./ MODIFY #16959844
./ MODIFY #16959844
./gtk-3.0/ MODIFY settings.ini.lock
./gtk-3.0/ MODIFY #235041463
./gtk-4.0/ MODIFY settings.ini.lock
./gtk-4.0/ MODIFY #302145488
./ MODIFY Trolltech.conf.lock
./ MODIFY #16961920

我们通过调查每个文件的内容定位到了kwinrc文件