Re: incron not seeing IN_CLOSE_WRITE?

On Sat, Dec 11, 2010 at 08:15:58AM +1000, Andrew Pollock wrote:
> Hi,
>
> I'm trying to use incron to invoke a program whenever some files change.
> e.g.
>
> /var/log/snort/snort.last IN_CLOSE_WRITE /some/program /var/log/snort/snort.last
>
> /var/log/snort/snort.last is created by a conventional cron job, which does
> a cp of /var/log/snort/alert to /var/log/snort/snort.last on a 5 minute
> interval.
>
> This rule only seems to execute once after restarting incron, and never
> again (despite the copies running every 5 minutes).
>

I think I may have figured out what is going on.

To use an example:

I have this incrontab entry:

/tmp/incrontest/snort.last IN_CLOSE_WRITE /tmp/incrontester /tmp/incrontest/snort.last snort

/tmp/incrontester is simply:

        #!/bin/bash

        mv $1 /tmp/incrontest/dst/${2}_$(date +%s)

So the job that incron runs moves the file that incron was watching to a
different directory.

Then if I copy a new file to the file that incron was watching, it doesn't
fire again. This is because the inode of the file is changing, because the
old file was moved out.

Is there any solution for this, or do I need watch the directory, and make
my job have enough smarts to only operate on the IN_CLOSE_WRITE for the file
I'm interested in?

regards

Andrew
Received on Tue Jun 05 2012 - 22:14:21 CEST