Monitor “file” specific events

A few days back, I was asked by my uncle to help him open an XLS file saved on a shared drive on windows machine. The file name was in the list of “recently opened file” in Microsoft Excel, however the file was missing from the original location, hence failed to open. I could not figure out whether file was deleted/moved to another location. That triggered a thought whether there is any tool which monitors the file/directory specific events like open/create, delete, modify, access etc in windows. I do not have windows pc handy, so next thing to try similar thing out on Linux.

Linux has some utilities which can be used to monitor above mentioned file events, called inotify-tools, which can be installed using following command in Ubuntu.

sudo apt-get install intofiy-tools

Following command will monitor the /tmp directory recursively under Linux for create, modify, delete events.

inotifywait -r /tmp/ -e create -e modify -e delete -m --format '%T %w%f %e' --timefmt '%F %k:%M:%S'

More information can be obtained from the man pages of  inotifywait command.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s