热门关键字:  PHP  Cisco  seo  网络广告 虚拟主机 中文域名
当前位置 :| 主页>服务器>Linux服务器>

使用Inotify 监控Linux 文件系统事件

来源:赛迪网技术社区 作者:Eli M. Dow  时间:2006-10-08 点击:
 

这对任何一个在 Linux 系统上进行过文件编程的人来说都应该是熟悉的。

/* This method does the dirty work of determining what happened,
   then allows us to act appropriately
*/
void handle_event (struct inotify_event *event)
{

   /* If the event was associated with a filename, we will store it here */
   char * cur_event_filename = NULL;


   /* This is the watch descriptor the event occurred on */
   int cur_event_wd = event->wd;

   if (event->len)
   {
      cur_event_filename = event->filename;
   }
   printf("FILENAME=%s
", cur_event_filename);
        printf("
");


   /* Perform event dependent handler routines */
   /* The mask is the magic that tells us what file operation occurred */
   switch (event->mask)
   {
      /* File was accessed */
      case IN_ACCESS:
         printf("ACCESS EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* File was modified */
      case IN_MODIFY:
         printf("MODIFY EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* File changed attributes */
      case IN_ATTRIB:
         printf("ATTRIB EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* File was closed */
      case IN_CLOSE:
         printf("CLOSE EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* File was opened */
      case IN_OPEN:
         printf("OPEN EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* File was moved from X */
      case IN_MOVED_FROM:
         printf("MOVE_FROM EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* File was moved to X */
      case IN_MOVED_TO:
         printf("MOVE_TO EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* Subdir was deleted */
      case IN_DELETE_SUBDIR:
         printf("DELETE_SUBDIR EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* File was deleted */
      case IN_DELETE_FILE:
         printf("DELETE_FILE EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* Subdir was created */
      case IN_CREATE_SUBDIR:
         printf("CREATE_SUBDIR EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* File was created */
      case IN_CREATE_FILE:
         printf("CREATE_FILE EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* Watched entry was deleted */
      case IN_DELETE_SELF:
         printf("DELETE_SELF EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* Backing FS was unmounted */
      case IN_UNMOUNT:
         printf("UNMOUNT EVENT OCCURRED: File "%s" on WD #%i
",
                 cur_event_filename, cur_event_wd);
      break;


      /* Too many FS events were received without reading them
         some event notifications were potentially lost.  */
      case IN_Q_OVERFLOW:
         printf("Warning: AN OVERFLOW EVENT OCCURRED: 
");
      break;


      case IN_IGNORED:
         printf("IGNORED EVENT OCCURRED: 
");
      break;


      /* Some unknown message received */
      default:
         printf ("UNKNOWN EVENT OCCURRED for file "%s" on WD #%i
",
              cur_event_filename, cur_event_wd);
      break;
   }
}

清单 3. 实际的事件处理例程

在每一条 case 语句中,您可以随意执行任意已实现并且满足需要的方法。

至于性能监控,您可以确定哪些文件是最经常被读取的和它们打开的持续时间。这种监控非常方便,因为在某些情况下,如果文件在短时间内被应用程序重复地读取,它会将文件缓存在内存中而不用返回磁盘去读取,从而提高性能。

很容易举出一些执行有趣操作的特定于事件的处理器的例子。比如,如果您是在为底层文件系统实现一个元数据存储索引,您可能会寻找文件创建事件,不久还会在该文件上触发一个元数据挖掘操作。在安全环境中,如果文件被写入一个无人可以写入的目录,您会触发某些形式的系统警报。

请注意,inotify 支持许多非常细粒度的事件 —— 例如 CLOSE 与 CLOSE_WRITE。

本文中的代码所列举的许多事件,可能您并不希望在每次代码运行时都看到。实际上,只要可能,您可以并且应该只请求对您的应用程序有用的事件子集。出于测试目的,本文章提供的代码通过严格使用完整掩码(如可下载的示例代码[请参阅 参考资料] 中 main 方法的第 51 行附近或者上面的 清单 1 中的第 29 行所执行的)展示了许多事件。应用程序员通常想要有更多选择,而您则需要更特定的掩码来满足您的需要。这使您可以从上述的 handle_event() 方法中的 catch 语句删除不感兴趣的条目。

结束语

当应用于性能监控、调试和自动化领域时,inotify 是一种用于监控 Linux 文件系统的、强大且细粒度的机制。使用本文提供的代码,您就可以编写能够以最低的性能开销响应或记录文件系统事件的应用程序。


最新评论共有 0 位网友发表了评论
发表评论
评论内容:不能超过250字,需审核,请自觉遵守互联网相关政策法规。
用户名: 密码:
匿名?
注册
赞助商连接
热点关注
相关文章