Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

watch command to notify on newly created files on linux

How to modify the below command to notify on creating a new file to /usr/local/mydir/ by linux user john ?

watch -d 'ls -l /usr/local/mydir/ | fgrep john'

ie I want to continually monitor and call an another script if any new file is created to /usr/local/mydir/.

As In production I cannot go for any tool instead of shell script. So can help me with shell scripting solution ?

share|improve this question
why not just use iwatch ? . works for us. – Sirex Feb 3 '12 at 12:47
up vote 8 down vote accepted

Instead of constantly pulling a directory this way, maybe try to use the inotify subsystem, which is designed for this purpose. For user space tools, have a look at the inotify-tools.

share|improve this answer

inotify suggested by SvenW is an excellent choice for this.

Just to be different: Alternative, more complete way for this kind of stuff is to use kernel audit subsystem and auditd. Just install auditd if it's not already installed and then use auditctl, in your case

auditctl -w /usr/local/mydir/ -p wa -F uid=john -k johnschangedfiles

would do.

Then you can run a report and see a very detailed log of what happened and when:

ausearch -f /usr/local/mydir/

This produces results similar to this:

time->Fri Feb  3 12:45:19 2012
type=PATH msg=audit(1328265919.961:11): item=0 name="/tmp/test/foo" inode=1839907 dev=fd:00 mode=0100664 ouid=500 ogid=500 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0
type=CWD msg=audit(1328265919.961:11):  cwd="/tmp"
type=SYSCALL msg=audit(1328265919.961:11): arch=c000003e syscall=2 success=yes exit=3 a0=7fffa6f4262e a1=941 a2=1b6 a3=3136fb0d0c items=1 ppid=12414 pid=23531 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=686 comm="touch" exe="/bin/touch" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="jpikkschangedfiles"
share|improve this answer

If you insist on using just standard tools, a script like the following might help:

ls -l /usr/local/mydir | grep john > /tmp/watchfile

while true; do
   sleep 10
   ls -l /usr/local/mydir | grep john > /tmp/watchfile2
   diff -q /tmp/watchfile /tmp/watchfile2 > /dev/null
   if [ $? -ne 0 ] ; then
       echo "File list changed" 
       exit ;
   cp /tmp/watchfile2 /tmp/watchfile

Replace the echoline with your desired action and remove the exit line if you want to run this script continuously.

Note: This will act on any modification of the directory listing, even if files just get updated, not added.

share|improve this answer
Thanks fro your response ... But if any file get deleted from [/usr/local/mydir] this also will differ the watchfile and watchfile2. I want to do the desired action only when the new file is created in [/usr/local/mydir]. – Aha Feb 3 '12 at 13:31
Yes. Getting this right and fitting for every situation is difficult (but possible). Therefore, I again suggest to use tools that are designed for this purpose. – Sven Feb 3 '12 at 13:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.