[Wolves] Monitoring everything

[Ron Wellsted]

On Sun, 2004-04-11 at 03:49, Peter Oliver wrote:
> On Fri, 9 Apr 2004, Aquarius wrote:
> 
> > I think it is enough, because FAM can monitor directories, and if you
> > monitor a directory you get notifications of changes, additions, and
> > deletions on files within it for free.
> 
> I don't think so.  Modifing an existing file does not result in any 
> changes to its containing directory.

Every file, directory, device and such on a file system is connected to
an inode (information node).  Among otherthings, this has 3 timestamps
associated with it.  These are the creation timestamp (ctime),
modification timestamp (mtime) and last access timestamp (atime).  The
ctime is set when the inode is created and will not normally change,
unless somebody wants to falsify this for some reason. ;) (or when
restoring the file from a backup).

The mtime is updated whenever the inode is modified, eg a file open for
writing is closed or for a directory inode when a file within the
directory is created or deleted.

The atime is updated whenever an inode is accessed, even for reads.

The upshot of all this is that creating, deleting or writing to a file
will change the mtime for a directory inode, but just reading a file
will not alter the mtime for it's directory.

"man ls" lists the options to display the various timestamps on each
inode.

HTH (or have I just left everyone totally confused?)

try a little experiment:
cd ~
mkdir tmp     # if you do not already have a ~/tmp
cd tmp
mkdir test
cd test
ls -la
ls -lac
ls -lau
sleep 60
touch file
ls -la
ls -lac
ls -lau
sleep 60
touch file
ls -la
ls -lac
ls -lau
sleep 60
echo hello world >>file
ls -la
ls -lac
ls -lau

"It is left as an exercise for the student..." to explain the results
(and spot any mistakes!)

-- 
Ron Wellsted
http://www.wellsted.org.uk
ron at wellsted.org.uk
N 52.567623, W 2.137621