#1 only first chang to a file gets noticed

closed
nobody
None
5
2007-03-07
2007-03-06
Ralf Gross
No

Hi,

I want to use iwatch to copy the /etc/hosts file after a modification to this file to a second directory. But this works only for the first change (edit /etc/hosts, save...) to this file. All other changes are ignored (regardless if I use the command line or the xml config).

iwatch-0.2.0# ./iwatch -v -e modify,create,close_write -c 'cp /etc/hosts /server/ftpd/pub/hosts' /etc/hosts
Watch /etc/hosts
[ 6/Mär/2007 16:11:37] IN_IGNORED /etc/hosts
[ 6/Mär/2007 16:11:37] * Command: cp /etc/hosts /server/ftpd/pub/hosts
[----nothing----]

strace excerpt:

poll(
[{fd=3, events=POLLIN|POLLPRI, revents=POLLIN}], 1, 60000) = 1
read(3, "\1\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0", 8192) = 16
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=837, ...}) = 0
stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=837, ...}) = 0
write(1, "[ 6/M\303\244r/2007 16:15:35] IN_IGNOR"..., 46[ 6/Mär/2007 16:15:35] IN_IGNORED /etc/hosts
) = 46
[...snip...]
[----------]
pid 19030] read(4, "", 4096) = 0
[pid 19030] close(5) = 0
[pid 19030] close(4) = 0
[pid 19030] close(1) = 0
[pid 19030] exit_group(0) = ?
Process 19005 resumed
Process 19030 detached
<... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 19030
--- SIGCHLD (Child exited) @ 0 (0) ---
rt_sigaction(SIGINT, {SIG_DFL}, NULL, 8) = 0
rt_sigaction(SIGQUIT, {SIG_DFL}, NULL, 8) = 0
read(4, "", 4) = 0
close(4) = 0
syscall_255(0x3, 0x1, 0x73, 0xba6458, 0, 0x503010, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1) = -1 (errno 22)
poll([{fd=3, events=POLLIN|POLLPRI}], 1, 60000) = 0
poll(

---> second change to /etc/hosts
---> nothing happens

[{fd=3, events=POLLIN|POLLPRI}], 1, 60000) = 0
poll([{fd=3, events=POLLIN|POLLPRI}], 1, 60000) = 0
poll([{fd=3, events=POLLIN|POLLPRI}], 1, 60000) = 0
poll([{fd=3, events=POLLIN|POLLPRI}], 1, 60000) = 0
poll([{fd=3, events=POLLIN|POLLPRI}], 1, 60000) = 0
poll(

The system is running debian etch with kernel 2.6.18-4-amd64.

Ralf

Discussion

  • Ralf Gross
    Ralf Gross
    2007-03-06

    Logged In: YES
    user_id=1466476
    Originator: YES

    Ok, this seems not to be an iwatch problem. inotifywatch noticed only one of three writes to the /etc/hosts file too.

    # inotifywatch -v -e modify /etc/hosts
    Establishing watches...
    Total of 1 watches.
    Finished establishing watches, now collecting statistics.
    total filename
    1 /etc/hosts

     
  • Ralf Gross
    Ralf Gross
    2007-03-06

    Logged In: YES
    user_id=1466476
    Originator: YES

    I don't know what I'm missing, but inotifywatch/iwatch is working for a file in /tmp, but not for /etc/hosts or /etc/services...

    # inotifywatch -v /tmp/test
    Establishing watches...
    Total of 1 watches.
    Finished establishing watches, now collecting statistics.
    total access modify attrib close_write close_nowrite open filename
    29 2 6 3 3 6 9 /tmp/test

    # inotifywatch -e modify -v /tmp/test
    Establishing watches...
    Total of 1 watches.
    Finished establishing watches, now collecting statistics.
    total modify filename
    8 8 /tmp/test

    # inotifywatch -e modify -v /etc/hosts
    Establishing watches...
    Total of 1 watches.
    Finished establishing watches, now collecting statistics.
    total filename
    1 /etc/hosts

    # inotifywatch -e modify -v /etc/services
    Establishing watches...
    Total of 1 watches.
    Finished establishing watches, now collecting statistics.
    total filename
    1 /etc/services

     
  • Cahya Wirawan
    Cahya Wirawan
    2007-03-06

    Logged In: YES
    user_id=1568862
    Originator: NO

    Hi,
    This could happend if the inode of the file is changed, and since inotify
    only watches the inode, you will not receive event notification of the same filename
    but with a difference inode number.
    It is the same case if you watch the /etc/shadow , you will get only 1 event notification
    after someone has changed his/her password. The reason is the passwd command create a temporary
    shadow file and make a change on it, and at the end it moves to the original shadow file. The
    shadow file will have now difference inode number, so any changes to this new file will not trigger
    an inotify event.
    Maybe you have similar action with your /etc/hosts file.
    Try to watch the directory /etc with option "-e all_events" , then you will see what happend with
    your hosts file.

    And actually this case is documented in readme file. Please have a look at the option -t,
    you can try to do like "iwatch -t hosts -c "command" /etc"

     
  • Ralf Gross
    Ralf Gross
    2007-03-07

    • status: open --> closed
     
  • Ralf Gross
    Ralf Gross
    2007-03-07

    Logged In: YES
    user_id=1466476
    Originator: YES

    Your are right the inode is changing. Though I don't know why it's changing when I edit /etc/hosts with vim an not when editing some other file in /tmp. The filter trick is working fine.