Re: File alteration events?

["Austin S. Hemmelgarn" <ahferroin7@gmail.com>]

On 2019-01-31 07:38, Ronald Schaten wrote:
> Hello everybody...
> 
> This is my first mail to this list, and -- as much as I'd like to be --
> I'm not a kernel developer. So please forgive me if this isn't the right
> place for questions like this. I'm thankful for any pointer into the
> right direction.
> 
> 
> The question:
> 
> I'm looking for a solution to track file changes on a fairly large
> filesystem. Many thousands of directories, millions of files.
> 
> The volume is shared to other computers, changes can come from different
> sources (NFS, Samba, local access...). So I think the kernel or the
> filesystem itself are the definitive source of information.
> 
> Does BTRFS have any mechanism that could be used to track every event?
> Or do you happen to know if the kernel does?
> 
> 
> What I tried till now:
> 
> - inotify: Doesn't work for a full volume, just for single inodes.
> 
> - fanotify: That's almost the solution, but I need to see rename and
>    delete events, too.
> 
> - btrfs subvolume find-new: As far as I know that only finds changes
>    between snapshots. I need something a little more real-timey, and I
>    have to know if the file has been changed once or several times.
> 
> 
BTRFS does not, anything like this is going to be in the VFS layer.

Given what you've said above, I'd suggest asking the VFS developers 
about the possibility of getting rename and delete events in fanotify, 
as that's likely to be the best option long-term.