How do I live monitor on linux what files get accessed created modified and deleted?

Question

How do I monitor from this moment on what files get accessed / modified / created / deleted. (in live mode), similar to fseventer / fslogger?

Answer 1

On unix system you can use inotify-tools, built on top of inotify kernel subsystem API.

By inotifywait you can have live mode monitoring on standard output:

inotifywait -m -r -e access -e modify -e create -e delete --format 'PATH:%w%f EVENTS:%,e' {{path_to_monitor}}

Notes:

• -m: monitor indefinitely
• -r: recursive monitor
• -e: specify file system events to be monitored
• --format: specify the output of the command

Example (command performed on monitored directory followed by realtime inotifywait output):

$ cd {{path_to_monitor}}
$ touch test
PATH:./test EVENTS:CREATE
$ rm test
PATH:./test EVENTS:DELETE