How to list inotify watches

cfr · 2013-10-21 20:01:45

Is there a way to determine the inotify watches in place and, ideally, which process created those watches?

The question I'm asking is essentially this (currently unanaswered) one and I'm asking for what is basically the same reason (but my thread is about a problem with SpiderOak rather than Dropbox). However, I'm posting this separately as it seems to be a general question but I'm drawing a blank. (This seems odd - I find it hard to believe this hasn't been asked - and answered - before.)

FWIW, I upped max_user_watches on my system and they still all got immediately eaten up. I'd really like to know exactly what is being watched and which process asked for the watch but all the documentation I can find tells me how to set up new watches which isn't really to the purpose.

jjacky · 2013-10-21 21:13:15

you could try this:

ps -p $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' -print 2> /dev/null | sed -e 's/^\/proc\/\([0-9]*\)\/.*/\1/')

Source & more info: http://unix.stackexchange.com/questions … -resources

cfr · 2013-10-21 22:58:52

jjacky wrote:

you could try this:
ps -p $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' -print 2> /dev/null | sed -e 's/^\/proc\/$[0-9]*$\/.*/\1/')
Source & more info: http://unix.stackexchange.com/questions … -resources

Brilliant! That's really helpful. I got a list of processes involved using

ps $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' 2>/dev/null | sed 's+/proc/\([^/]*\)/fd/.*+\1+')

I then did this

echo 1 >| /sys/kernel/debug/tracing/events/syscalls/sys_exit_inotify_add_watch/enable

Then check that the result of this is 1

cat /sys/kernel/debug/tracing/tracing_on

Restart process(es) suspected of creating large numbers of watches. You can use

ps $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' 2>/dev/null | sed 's+/proc/\([^/]*\)/fd/.*+\1+')

to find the PIDs as above. This was not very useful in my case as I think SpiderOak must start a child process which had then exited so I couldn't cross-reference a PID to the trace results. Since that was the only application I'd just started, though, it seems fair to attribute the watches created by the new PID to such a child process.

Read /sys/kernel/debug/tracing/trace to see who creates which watches.

I specifically used:

cat /sys/kernel/debug/tracing/trace > /tmp/a
grep inotify_add_watch /tmp/a | wc -l

to get the number of new watches created. [Result: 65375!!]

When done

echo 0 >| /sys/kernel/debug/tracing/events/syscalls/sys_exit_inotify_add_watch/enable

This doesn't show which files and directories the process wanted watching which is a shame but it does give a sense of the enormity of its demands.

[Not relevant to this thread but none of this yet explains why the damn thing is suddenly doing this either!]

Last edited by cfr (2013-10-21 23:00:27)

Trilby · 2013-10-22 00:13:50

Sorry for the OT, but as I can't find a way to google for such a thing, what is the ">|" syntax doing? Is that different (or how so) from just a ">" output redirection?

jasonwryan · 2013-10-22 00:31:55

cfr probably has noclobber set in .bashrc

Trilby · 2013-10-22 00:35:15

Thanks, still learning new *nix-bits every day. (>| example)

cfr · 2013-10-22 01:02:46

jasonwryan wrote:

cfr probably has noclobber set in .bashrc

That's it. This I actually set for my own account as well but I do also have extra stuff set for root.

EDIT: There is an argument that you shouldn't do this because you come to rely on it and expect the safety net to be there even on other machines. However, I'm routinely much more careful on other people's machines than my own!

Last edited by cfr (2013-10-22 01:05:57)

Arch Linux

#1 2013-10-21 20:01:45

How to list inotify watches

#2 2013-10-21 21:13:15

Re: How to list inotify watches

#3 2013-10-21 22:58:52

Re: How to list inotify watches

#4 2013-10-22 00:13:50

Re: How to list inotify watches

#5 2013-10-22 00:31:55

Re: How to list inotify watches

#6 2013-10-22 00:35:15

Re: How to list inotify watches

#7 2013-10-22 01:02:46

Re: How to list inotify watches

Board footer