利用Inotify监控文件变化
1. inotify 既可以监视文件，也可以监视目录。程序采用python
系统是centos
easy_install pyinotify
2. Inotify 可以监视的文件系统事件包括：
IN_ACCESS，即文件被访问
IN_MODIFY，文件被 write
IN_ATTRIB，文件属性被修改，如 chmod、chown、touch 等
IN_CLOSE_WRITE，可写文件被 close
IN_CLOSE_NOWRITE，不可写文件被 close
IN_OPEN，文件被 open
IN_MOVED_FROM，文件被移走,如 mv
IN_MOVED_TO，文件被移来，如 mv、cp
IN_CREATE，创建新文件
IN_DELETE，文件被删除，如 rm
IN_DELETE_SELF，自删除，即一个可执行文件在执行时删除自己
IN_MOVE_SELF，自移动，即一个可执行文件在执行时移动自己
IN_UNMOUNT，宿主文件系统被 umount
IN_CLOSE，文件被关闭，等同于(IN_CLOSE_WRITE | IN_CLOSE_NOWRITE)
IN_MOVE，文件被移动，等同于(IN_MOVED_FROM | IN_MOVED_TO)
3. python 简单实例
# -*- coding: utf-8 -*-
'''
Created on 2014-5-9
@author: xie
'''
import pyinotify
FLAG_COLLECTIONS = pyinotify.EventsCodes.FLAG_COLLECTIONS
class EventHandler(pyinotify.ProcessEvent):
#自定义写入那个文件，可以自己修改
# def process_IN_ACCESS(self, event):#即文件被访问
# print "ACCESS event:", event.pathname
# print ("ACCESS event : %s %s" % (os.path.join(event.path,event.name),datetime.datetime.now()))
def process_IN_ATTRIB(self, event): #文件属性被修改，如 chmod、chown、touch 等
print event.pathname
# if event.name.startswith('.conf'):
# print "ACCESS event:", event.pathname
# def process_IN_CLOSE_NOWRITE(self, event):#不可写文件被 close
# print "CLOSE_NOWRITE event:", event.pathname
# print("CLOSE_NOWRITE event : %s %s" % (os.path.join(event.path,event.name),datetime.datetime.now()))
# def process_IN_CLOSE_WRITE(self, event):#可写文件被 close
# print "ACCESS event:", event.pathname
# self.xie()
def process_IN_CREATE(self, event):#创建新文件
print event.pathname
# if event.name.startswith('.conf'):
# print "ACCESS event:", event.pathname
def process_IN_DELETE(self, event):#文件被删除，如 rm
print event.pathname
# if event.name.startswith('.conf'):
# print "ACCESS event:", event.pathname
def process_IN_MODIFY(self, event):#文件被 write
print event.pathname
# if event.name.startswith('.conf'):
# print "ACCESS event:", event.pathname
# def process_IN_OPEN(self, event):#文件被 open
# print "OPEN event:", event.pathname
# print("OPEN event : %s %s" % (os.path.join(event.path,event.name),datetime.datetime.now()))
def main():
pyinfo = pyinotify.WatchManager()
mask = FLAG_COLLECTIONS['OP_FLAGS']['IN_ATTRIB'] | FLAG_COLLECTIONS['OP_FLAGS']['IN_CREATE'] | FLAG_COLLECTIONS['OP_FLAGS']['IN_DELETE'] | FLAG_COLLECTIONS['OP_FLAGS']['IN_MODIFY']
#mask or pyinotify.ALL_EVENTS
pyinfo.add_watch('/home/xie/log', mask, rec=True)
pyinfo.add_watch('/home/xie/soft', mask, rec=True)
notifier = pyinotify.Notifier(pyinfo, EventHandler())
# 1.
while True:
try:
notifier.process_events()
if notifier.check_events():
notifier.read_events()
except KeyboardInterrupt:
pass
notifier.stop()
break
#or 2. notifier.loop()
if __name__ == '__main__':
main()