APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

Watching File or Directory Changes

© December 2005 Tony Lawrence

Many modern systems provide a way to watch a directory for events (new files, reading the directory, modification of a file in the directory, etc.). This facility can be done in various ways, from providing hooks in the filesystem code itself to something that watches for inode changes. Linux and BSD have several possibilities in that regard, but Mac doesn't give us much at the shell level.

There is FileMonitor (shareware), and it's certainly possible that some of the BSD tools might compile on OS X. But what do you do when there is no support in the OS?

Brute Force

Typically you are interested in new files in a particular directory. You can do something like this:

 touch /tmp/testdirb.$$
 while true
 ls /testdir > /tmp/testdira.$$
 diff /tmp/testdira.$$ /tmp/testdirb.$$ || echo "changed"
 cp /tmp/testdira.$$ /tmp/testdirb.$$
 sleep 300

If you were looking for a particular file to change, you'd use "ls -l", and if your interest was in if the file was being used or executed, "ls -lut" would give you that. This example just echoes when something changes, but you would more likely call some other script that did more testing. One obvious issue that comes up if a file has been created is waiting for the creating program to have finished up: lsof or fuser can help you with that.

But this is all pretty crude. Sometimes crude is fine, but if you need to know more often, there's a fair amount of overhead in this that you really don't need.

If it is just one file, and your interest is additions to it, the mailchecking utility in your shell can give you alerts. For example, in bash:


You can watch multiple files, each with its own message, by using MAILPATH instead of MAIL. You need to "unset MAIL", and set and export MAILPATH:

 unset MAIL
 MAILPATH='/tmp/foo/h?"H is changed":/tmp/foo/a?"A has changed"'
 export MAILPATH

That's a little clumsy and interfers with real mail if you use it.


Mac OS X does have a command line "stat" that can make checking changes a little less intensive. "stat testdir" looks something like this:

 234881029 7966131 drwxr-xr-x 5 apl staff 0 170 "Sep  4 15:40:50 2005" "Sep  4 15:47:31 2005" "Sep  4 15:47:31 2005" 4096 0 0 testdir

which is everything you want to know about the file or directory for this purpose. Read the man page for details; there are quite a few options and control of output format. You'd need to build a checking loop something like this:

 OLD=`stat  testdir`
 while true
 NEW=`stat testdir`
 [ "$NEW" == "$OLD" ] || echo "changed!"
 sleep 3

Perl or C

From Perl or C (and of course many other languages), you can get access to the stat information a bit more easily. Here's a simple Perl example:

 @info=stat("testdir") or die "Can't stat testdir $!";
 while (1) {
 @newinfo=stat("testdir") or die "Can't stat testdir $!";
 @what=qw(Device Inum Mode Links Owner Group Rdev Size Atime Mtime Ctime PBlock Blocks);
 foreach(@info) {
   print "Change $what[$x] $info[$x] $newinfo[$x]\n" if ($info[$x] ne $newinfo[$x]);
 sleep 1;

Of course you'd probably do more than just announce the change.

Got something to add? Send me email.

(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

-> Watching File or Directory Changes


Inexpensive and informative Apple related e-books:

Take Control of Parallels Desktop 12

Take Control of OS X Server

El Capitan: A Take Control Crash Course

Take Control of Upgrading to El Capitan

Take Control of Preview

More Articles by © Tony Lawrence

Sun Dec 30 18:49:51 2007: 3359   TonyLawrence

See "man opensnoop" if you have Leopard. Also see article here : (link)


Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us

Printer Friendly Version

Simplicity is prerequisite for reliability. ((Edsger W. Dijkstra)

Linux posts

Troubleshooting posts

This post tagged:

Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode