Question

I have the following (crude) function, which continually watches a directory for new files and files being deleted, recording such changes. It correctly records all new files and directories, but doesn’t seem to react at all to files or directories being deleted.

It appears to be the read() call which doesn’t return as it should when files are being deleted, though it does for files being created.

The function is being called as one of two independent threads, though at present the other thread doesn’t do anything (just an empty, infinite loop as a placeholder).

void* watchfs(void* arg) {
    int infp, watch, length, i ;
    char buffer[EVENT_BUF_LEN] ;
    struct inotify_event* event ;

    if ((infp = inotify_init()) < 0) {
        fatal("inotify: Could not initialize") ;
    }

    watch = inotify_add_watch(infp, userdir, IN_CREATE | IN_DELETE) ;

    for (;;) {
        length = read(infp, buffer, EVENT_BUF_LEN) ;
        if (length < 0) {
            fatal("inotify: Could not read events") ;
        }

        i = 0 ;
        while (i < length) {
            event = (struct inotify_event*) &buffer[i] ;

            if (event->len) {
                if (event->mask & IN_CREATE) {
                    if (event->mask & IN_ISDIR) {
                        record(LOG_FILESYS, "New directory created") ;
                    } else {
                        record(LOG_FILESYS, "New file created") ;
                    }
                } else if (event->mask & IN_DELETE) {
                    if (event->mask & IN_ISDIR) {
                        record(LOG_FILESYS, "Directory deleted") ;
                    } else {
                        record(LOG_FILESYS, "File deleted") ;
                    }
                }
            }

            i += EVENT_SIZE + event->len ;
        }
    }

    inotify_rm_watch(infp, watch) ;
    close(infp) ;

    return 0 ;
}

Answer 1

Finally figured out what is going on. Linux, or perhaps Gnome, doesn’t actually delete files but simply moves them around. Even when a file is simply renamed it is apparently moved somewhere, then a new file with the new name is moved into the folder from somewhere else (a temp folder somewhere?). The rm command actually deletes a file and my code registers that as an IN_DELETE event as expected. Deleting files or directories in Gnome however registers as IN_MOVED_TO, while renaming registers as IN_MOVED_TO followed by IN_MOVED_FROM.

I thought I had checked for this as one of the first things, but clearly not well enough.