🔍 3 Ways to Monitor File Changes in Linux at the OS Level

Ever needed to know the moment a file changes on your system? Linux gives you three built-in mechanisms for that.

1️⃣ inotify (the go-to choice)

The most popular way. Install inotify-tools and you're one command away:

inotifywait -r -m -e modify,create,delete /path/to/dir

Event-driven, lightweight, perfect for most use cases. Just watch out for the per-user watch limit (/proc/sys/fs/inotify/max_user_watches).

2️⃣ fanotify (the big gun)

Unlike inotify, fanotify works at the mount point level — it can monitor an entire filesystem without setting a watch on every single file. This is what antivirus engines use under the hood.

The easiest way to try it is fatrace:

sudo apt install fatrace
sudo fatrace
sudo fatrace -f W -c   # only writes, with command names

The trade-off: requires root and has a more complex C API for programmatic use.

3️⃣ auditd (the forensic tool)

When you need to know not just what changed, but who changed it and which process did it:

sudo auditctl -w /etc/passwd -p wa -k passwd_changes
sudo ausearch -k passwd_changes

Full audit trail with PIDs, UIDs, and timestamps. Heavier than the other two, but invaluable for security and compliance.

TL;DR:
— Need to react to changes → inotify
— Need to watch everything at once → fanotify
— Need to know who did it → auditd

#linux #sysadmin #monitoring #devops

/btw #claude

Opus 4.7

Bash Script 4 Put All JetBrains Projects to Desktop Links / Main Menu

https://github.com/makhnanov/create-jb-launchers

bash <(curl -fsSL https://cdn.jsdelivr.net/gh/makhnanov/create-jb-launchers@main/create-jb-launchers.sh)

ToDo: --non-interactive & cron

#webstorm #jetbrains #bash #projects

Chrome / apt / snap