Linux Tips

How do I know exactly when a file gets created, modified, or deleted?

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #51:

Try: inotifywait -m -r -e create,modify,delete,move --timefmt '%Y-%m-%d %H:%M:%S' --format '%T %w%f %e' /var/www

Info: inotifywait uses Linux kernel APIs for efficient file monitoring. -m runs continuously, -r recurses through subdirectories, and -e filters the specified events.

Examples:

  • $ inotifywait -m -e close_write /uploads | while read path event file; do process.sh "$path$file"; done  # Trigger script on write
  • $ inotifywait -m --exclude '\.tmp$' /home/linuxteck  # Ignore temp files
  • $ inotifywatch -v -e access -t 60 /var/log  # Collect statistics over 60s

Note: Requires the inotify-tools package (sudo apt install inotify-tools). Kernel events fire instantly with minimal CPU overhead.




LinuxTeck.com 
linuxteck@ubuntu:~$ inotifywait -m -r -e create,modify,delete,move --timefmt '%Y-%m-%d %H:%M:%S' --format '%T %w%f %e' /var/www
Setting up watches.  Beware: since -r was given, this may take a while!
Watches established.
2026-08-22 10:23:45 /var/www/uploads/photo.jpg CREATE
2026-08-22 10:24:12 /var/www/config.php MODIFY
2026-08-22 10:25:33 /var/www/cache/session_old.dat DELETE
2026-08-22 10:26:01 /var/www/logs/access.log MODIFY
2026-08-22 10:26:45 /var/www/uploads/document.pdf CREATE
linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #50: I have a file's inode but not its path. How do I find it? NEXT ARTICLE Quick Linux Tip #52: My rsync is saturating my connection. How do I cap its bandwidth?
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.