linux文件监视器实现基于inotify

功能实现
Inotify API用于检测文件系统变化的机制，比如新建文件、文件更新等等。Inotify可用于检测单个文件，也可以检测整个目录。

函数
inotify_init(void)
创建一个inotify的实例，
返回inotify事件队列的文件描述符。

内核也提供了inotify_init1(int flags)接口函数
flag等于0的，该函数等价于inotify_init(void)函数。

inotify_add_watch(int fd, const char* pathname, uint32_t mask)
添加“watch list”，检测列表。
fd就是inotify_init的返回值，
pathname是要检测目录或者文件的路径，
mask就是要检测的事件类型。
返回 成功则是一个unique的watch描述符。

inotify_rm_watch(int fd, int wd)
从watch list种移除检测的对象。

使用流程
1、初始化
2、读取文件
3、判断事件处理

事件结构体

struct inotify_event {
   int      wd;       /* Watch descriptor */
   uint32_t mask;     /* Mask of events */
   uint32_t cookie;   /* Unique cookie associating related
						 events (for rename(2)) */
   uint32_t len;      /* Size of name field */
   char     name[];   /* Optional null-terminated name */
};

wd: 检测的对象的watch descriptor
mask: 检测事件的mask
cookie: 和rename事件相关
len: name字段的长度
name: 检测对象的name`

事件类型：
IN_ACCESS File was accessed (read) ().
IN_ATTRIB Metadata changed, e.g., permissions, timestamps, extended
attributes, link count (since Linux 2.6.25), UID, GID, etc.().
IN_CLOSE_WRITE File opened for writing was closed ().
IN_CLOSE_NOWRITE File not opened for writing was closed ().
IN_CREATE File/directory created in watched directory ().
IN_DELETE File/directory deleted from watched directory ().
IN_DELETE_SELF Watched file/directory was itself deleted.
IN_MODIFY File was modified ().
IN_MOVE_SELF Watched file/directory was itself moved.
IN_MOVED_FROM File moved out of watched directory ().
IN_MOVED_TO File moved into watched directory ().
IN_OPEN File was opened ().

示例：

#include <sys/inotify.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
int watch_inotify_events(int fd)
{
	char event_buf[512];
	int ret;
	int event_pos = 0;
	int event_size = 0;
	struct inotify_event *event;
	
	/*读事件是否发生，没有发生就会阻塞*/
	ret = read(fd, event_buf, sizeof(event_buf));
	
	/*如果read的返回值，小于inotify_event大小出现错误*/
	if(ret < (int)sizeof(struct inotify_event))
	{
		printf("counld not get event!\n");
		return -1;
	}
	
	/*因为read的返回值存在一个或者多个inotify_event对象，需要一个一个取出来处理*/
	while( ret >= (int)sizeof(struct inotify_event) )
	{
		event = (struct inotify_event*)(event_buf + event_pos);
		if(event->len)
		{
			if(event->mask & IN_CREATE)
			{
				printf("create file: %s\n",event->name);
			}
			else
			{
				printf("delete file: %s\n",event->name);
			}
		}
		
		/*event_size就是一个事件的真正大小*/
		event_size = sizeof(struct inotify_event) + event->len;
		ret -= event_size;
		event_pos += event_size;
	}
	
	return 0;
}
 
int main(int argc, char** argv)
{
	int InotifyFd;
	int ret;
	
	if (argc != 2)
	{
		printf("Usage: %s <dir>\n", argv[0]);
		return -1;
	}
	
	/*inotify初始化*/
	InotifyFd = inotify_init();
	if( InotifyFd == -1)
	{
		printf("inotify_init error!\n");
		return -1;
	}
	
	/*添加watch对象*/
	ret = inotify_add_watch(InotifyFd, “pic/”, IN_CREATE |  IN_DELETE);
	
	/*处理事件*/
	watch_inotify_events(InotifyFd);
 
    /*删除inotify的watch对象*/
	if ( inotify_rm_watch(InotifyFd, ret) == -1) 
	{
		printf("notify_rm_watch error!\n");
		return -1;
	}
	
	/*关闭inotify描述符*/
	close(InotifyFd);
	
	return 0;
}

编译
gcc inotify.c -o inotify

在执行程序目录新建pic目录
mkdir pic

后台运行程序
./inotify&

在pic目录新建文件
touch pic/1.txt

现象
终端打印
create file: 1.txt