# watch a directory for file changes

## XenoTerraCide

I need a program that will watch a directory for file changes... it would be great if it could log what application/user/group made those changes.

----------

## mikegpitt

You might want to take a look at dazuko:  http://dazuko.dnsalias.org/wiki/index.php/Main_Page

Dazuko is a kernel patch that allows for notification for file changes.  I would recommend patching the kernel yourself instead of using the version in portage.  Although dazuko is only the kernel patch, I'm guessing there are examples or utilities that utilize it.

BTW - If you need help patching the kernel, I wrote a howto on how to use dazuko with clamav a while ago:

https://forums.gentoo.org/viewtopic-t-604709.html

----------

## XenoTerraCide

hmmm... remind me what dazuko does that inotify doesn't?

EDIT: yeah I ran the whole dazuko clamav thing back in the day... clamav isn't something I need in this case....

at least I hope I haven't managed to find a linux virus.

----------

## Tekeli Li

Wait, what's wrong with fam/gamin? There are even Python bindings...

----------

## makism

i think pyinotify is pretty cool. using python bindings is very easy to do your job...

it`s in the portage alright...

----------

## mikegpitt

 *XenoTerraCide wrote:*   

> hmmm... remind me what dazuko does that inotify doesn't?

 Dazuko is a little more comprehensive than inotify.  I believe inotify only works with individual files and can only see file changes, where as dazuko can handle whole directories, and other attributes like file access, etc.

Don't hold me to the above statement however   :Wink: 

----------

## XenoTerraCide

I'm not saying dazuko isn't awesome, but it's probably more work than I need in this case.

hmm.... pyinotify sounds interestings... too bad I don't know more about python, although at this point it does sound like I'm gonna have to write at least part of the tool to do what I need.

----------

## makism

here is a list of events that pyinotify can handle: http://pyinotify.sourceforge.net/#The_EventsCodes_Class

this is the first time i`ve heard of dazuko and i`m curious about it :p i`ll google it...

----------

## M

And for something simpler just emerge http://inotify-tools.sourceforge.net/ . Command line tools for inotify.

----------

## XenoTerraCide

I just noticed the fam/gamin comment. so thus far will any of these tell me which application is modifying these files...

----------

