You are not logged in.

#1 2013-10-21 20:01:45

cfr
Member
From: Cymru
Registered: 2011-11-27
Posts: 7,144

How to list inotify watches

Is there a way to determine the inotify watches in place and, ideally, which process created those watches?

The question I'm asking is essentially this (currently unanaswered) one and I'm asking for what is basically the same reason (but my thread is about a problem with SpiderOak rather than Dropbox). However, I'm posting this separately as it seems to be a general question but I'm drawing a blank. (This seems odd - I find it hard to believe this hasn't been asked - and answered - before.)

FWIW, I upped max_user_watches on my system and they still all got immediately eaten up. I'd really like to know exactly what is being watched and which process asked for the watch but all the documentation I can find tells me how to set up new watches which isn't really to the purpose.


CLI Paste | How To Ask Questions

Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L

Offline

#2 2013-10-21 21:13:15

jjacky
Member
Registered: 2011-11-09
Posts: 347
Website

Re: How to list inotify watches

you could try this:

ps -p $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' -print 2> /dev/null | sed -e 's/^\/proc\/\([0-9]*\)\/.*/\1/')

Source & more info: http://unix.stackexchange.com/questions … -resources

Offline

#3 2013-10-21 22:58:52

cfr
Member
From: Cymru
Registered: 2011-11-27
Posts: 7,144

Re: How to list inotify watches

jjacky wrote:

you could try this:

ps -p $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' -print 2> /dev/null | sed -e 's/^\/proc\/\([0-9]*\)\/.*/\1/')

Source & more info: http://unix.stackexchange.com/questions … -resources

Brilliant! That's really helpful. I got a list of processes involved using

ps $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' 2>/dev/null | sed 's+/proc/\([^/]*\)/fd/.*+\1+')

I then did this

echo 1 >| /sys/kernel/debug/tracing/events/syscalls/sys_exit_inotify_add_watch/enable

Then check that the result of this is 1

cat /sys/kernel/debug/tracing/tracing_on

Restart process(es) suspected of creating large numbers of watches. You can use

ps $(find /proc/*/fd/* -type l -lname 'anon_inode:inotify' 2>/dev/null | sed 's+/proc/\([^/]*\)/fd/.*+\1+')

to find the PIDs as above. This was not very useful in my case as I think SpiderOak must start a child process which had then exited so I couldn't cross-reference a PID to the trace results. Since that was the only application I'd just started, though, it seems fair to attribute the watches created by the new PID to such a child process.

Read /sys/kernel/debug/tracing/trace to see who creates which watches.

I specifically used:

cat /sys/kernel/debug/tracing/trace > /tmp/a
grep inotify_add_watch /tmp/a | wc -l

to get the number of new watches created. [Result: 65375!!]

When done

echo 0 >| /sys/kernel/debug/tracing/events/syscalls/sys_exit_inotify_add_watch/enable

This doesn't show which files and directories the process wanted watching which is a shame but it does give a sense of the enormity of its demands.

[Not relevant to this thread but none of this yet explains why the damn thing is suddenly doing this either!]

Last edited by cfr (2013-10-21 23:00:27)


CLI Paste | How To Ask Questions

Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L

Offline

#4 2013-10-22 00:13:50

Trilby
Inspector Parrot
Registered: 2011-11-29
Posts: 29,761
Website

Re: How to list inotify watches

Sorry for the OT, but as I can't find a way to google for such a thing, what is the ">|" syntax doing?  Is that different (or how so) from just a ">" output redirection?


"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman

Online

#5 2013-10-22 00:31:55

jasonwryan
Anarchist
From: .nz
Registered: 2009-05-09
Posts: 30,424
Website

Re: How to list inotify watches

cfr probably has noclobber set in .bashrc


Arch + dwm   •   Mercurial repos  •   Surfraw

Registered Linux User #482438

Offline

#6 2013-10-22 00:35:15

Trilby
Inspector Parrot
Registered: 2011-11-29
Posts: 29,761
Website

Re: How to list inotify watches

Thanks, still learning new *nix-bits every day. (>| example)


"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman

Online

#7 2013-10-22 01:02:46

cfr
Member
From: Cymru
Registered: 2011-11-27
Posts: 7,144

Re: How to list inotify watches

jasonwryan wrote:

cfr probably has noclobber set in .bashrc

That's it. This I actually set for my own account as well but I do also have extra stuff set for root.

EDIT: There is an argument that you shouldn't do this because you come to rely on it and expect the safety net to be there even on other machines. However, I'm routinely much more careful on other people's machines than my own!

Last edited by cfr (2013-10-22 01:05:57)


CLI Paste | How To Ask Questions

Arch Linux | x86_64 | GPT | EFI boot | refind | stub loader | systemd | LVM2 on LUKS
Lenovo x270 | Intel(R) Core(TM) i5-7200U CPU @ 2.50GHz | Intel Wireless 8265/8275 | US keyboard w/ Euro | 512G NVMe INTEL SSDPEKKF512G7L

Offline

Board footer

Powered by FluxBB