小记——inotify文件监控

我就是我 2022-09-23 14:52 162阅读 0赞

Linux provides an interface, inotify, for monitoring files—for example, to see when they are moved, read from, written to, or deleted.

Linux提供了inotify接口来监控文件——例如，文件的移动、读取、写入或者删除。

1. 初始化inotify

#include <sys/inotify.h>
    int inotify_init1 (int flags);

The flags parameter is usually 0, but may be a bitwise OR of the following flags:  
IN\_CLOEXEC  
Sets close-on-exec on the new file descriptor.  
IN\_NONBLOCK  
Sets O\_NONBLOCK on the new file descriptor.  
On error, inotify\_init1() returns −1 and sets errno to one of the following codes:  
EMFILE  
The per-user limit on the maximum number of inotify instances has been reached.  
ENFILE  
The system-wide limit on the maximum number of file descriptors has been  
reached.  
ENOMEM  
There is insufficient memory available to complete the request.

2. 添加新的监控

#include <sys/inotify.h>
    int inotify_add_watch (int fd,
    const char *path,
    uint32_t mask);

On success, the call returns a new watch descriptor. On failure, inotify\_add\_watch() returns −1 and sets errno to one of the following:  
EACCES  
Read access to the file specified by path is not permitted. The invoking process must be able to read the file to add a watch to it.  
EBADF  
The file descriptor fd is not a valid inotify instance.  
EFAULT  
The pointer path is not valid.  
EINVAL  
The watch mask, mask, contains no valid events.  
ENOMEM  
There is insufficient memory available to complete the request.  
ENOSPC  
The per-user limit on the total number of inotify watches has been reached.  
**Watch masks**  
The watch mask is a binary OR of one or more inotify events, which <inotify.h> defines:

IN\_ACCESS  
The file was read from.

IN\_MODIFY  
The file was written to.

IN\_ATTRIB  
The file’s metadata (for example, the owner, permissions, or extended attributes) was changed.

IN\_CLOSE\_WRITE  
The file was closed and had been open for writing.

IN\_CLOSE\_NOWRITE  
The file was closed and had not been open for writing.

IN\_OPEN  
The file was opened.

IN\_MOVED\_FROM  
A file was moved away from the watched directory.

IN\_MOVED\_TO  
A file was moved into the watched directory.

IN\_CREATE  
A file was created in the watched directory.

IN\_DELETE  
A file was deleted from the watched directory.

IN\_DELETE\_SELF  
The watched object itself was deleted.

IN\_MOVE\_SELF  
The watched object itself was moved.

The following events are also defined, grouping two or more events into a single value:

IN\_ALL\_EVENTS  
All legal events.

IN\_CLOSE  
All events related to closing (currently, both IN\_CLOSE\_WRITE and IN\_CLOSE\_NOWRITE).

IN\_MOVE  
All move-related events (currently, both IN\_MOVED\_FROM and IN\_MOVED\_TO).

3. 读取监控（有变化时）

#include <sys/inotify.h>
    struct inotify_event {
    int wd; /* watch descriptor */
    uint32_t mask; /* mask of events */
    uint32_t cookie; /* unique cookie */
    uint32_t len; /* size of 'name' field */
    char name[]; /* nul-terminated name */
    };

特别要注意name字段，它是一个zero-length arrays. 后面会有其用法例子。

char buf[BUF_LEN] __attribute__((aligned(4)));
    ssize_t len, i = 0;
    /* read BUF_LEN bytes' worth of events */
    len = read (fd, buf, BUF_LEN);
    /* loop over every read event until none remain */
    while (i < len) {
    struct inotify_event *event =
    (struct inotify_event *) &buf[i];
    printf ("wd=%d mask=%d cookie=%d len=%d dir=%s\n",
    event->wd, event->mask,
    event->cookie, event->len,
    (event->mask & IN_ISDIR) ? "yes" : "no");
    /* if there is a name, print it */
    if (event->len)
    printf ("name=%s\n", event->name);
    /* update the index to the start of the next event */
    i += sizeof (struct inotify_event) + event->len;
    }

4. 移除监控

#include <inotify.h>
    int inotify_rm_watch (int fd, uint32_t wd);

5. 销毁inotify实例

#include <inotify.h>
    int inotify_rm_watch (int fd, uint32_t wd);

==>例程：监控日志文件的变化，并将其变化打印在屏幕上

#include <sys/inotify.h>
    #include <stdio.h>
    #include <stdlib.h>
    #include <sys/types.h>
    #include <sys/stat.h>
    #include <unistd.h>
    #include <fcntl.h>
    
    #define INOTIFY_LEN 1024
    #define BUFFER_LEN 1024
    
    int main()
    {
    	int fd;
    	fd = inotify_init1(0);
    	if (fd == -1)
    	{
    		perror("inotify_init1");
    		exit(EXIT_FAILURE);
    	}
    	int wd = inotify_add_watch(fd, "./log.log", IN_CLOSE_WRITE);
    	if (wd == -1)
    	{
    		perror("inotify_add_watch");
    		exit(EXIT_FAILURE);
    	}
    	char buf[INOTIFY_LEN] __attribute__((aligned(4)));
    	ssize_t len;
    	off_t curr = 0;
    	char f_buf[BUFFER_LEN];
    	//
    	int f_fd = open("./log.log", O_RDONLY);
    	if (f_fd == -1)
    	{
    		perror("open");
    		exit(EXIT_FAILURE);
    	}
    	curr = lseek(f_fd, 0, SEEK_END);
    	close(f_fd);
    	while(1)
    	{
    		//wait the inotify event
    		len = read(fd, buf, INOTIFY_LEN);
    		//
    		f_fd = open("./log.log", O_RDONLY);
    		if (f_fd == -1)
    		{
    			perror("open");
    			exit(EXIT_FAILURE);
    		}
    		off_t n_curr = lseek(f_fd, 0, SEEK_END);
    		if (n_curr > curr)
    		{
    			pread(f_fd, f_buf, BUFFER_LEN, curr);
    			f_buf[n_curr - curr] = '\0';
    			printf("%s\n", f_buf);
    			curr = n_curr;
    			close(f_fd);
    		}
    	}
    	close(fd);
    	return 0;
    }