iNotify 能否告诉我受监控的文件移动到了哪里？
我想在文件在系统中移动时对其进行监视。 iNotify 可以在它移动时告诉我它的新位置吗？
I want to monitor a file while it's moving in the system. Can iNotify tell me its new position whenever it's moves?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您同时查看文件移出的目录和文件移至的目录，那么您将在源目录上收到一个
IN_MOVED_FROM事件和一个IN_MOVED_TO目标目录上的事件，两者都具有相同的cookie。然后，您可以使用两个事件的name字段来查找文件移入和移出的位置。如果您只查看源目录，或者只查看目标目录，那么您将只能获得其中一个事件，因此您只能获得一半的信息。这是 inotify 的限制。
If you're watching both the directory the file was moved from, and the directory the file was moved to, then you will receive an
IN_MOVED_FROMevent on the source directory and anIN_MOVED_TOevent on the target directory, both with the samecookie. You can then use thenamefields of the two events to find out where the file was moved to and from.If you're only watching the source directory, or only the target directory, then you will only get one of the events, so you will only have half of the info. This is a limitation of inotify.
您可以在移动之前获取文件的文件描述符并读取符号链接：
其中 $fd 是您的文件描述符，此文件描述符将指向您的文件。注意我只在 ext4 上测试过它，它适用于 LVM2，但不适用于 OverlayFS。另外，打开文件描述符将阻止为该文件触发删除事件。
Linux内核版本之间也可能存在问题
You can grab a file descriptor to the file before the move and read the symlink at:
where $fd is your file descriptor, this file descriptor will point to your file. Note I have only tested this on ext4 and it works with LVM2, but does not work with OverlayFS. Also opening a file descriptor will block remove events from being fired for the file.
There may also be issues between linux kernel versions
根据@slightly_toasted的回答那里，您可以使用
sudoauditctl -a always,exit -F arch=b64 - S 重命名、rmdir、取消链接、取消链接、重命名 -F dir=/path/to/folder/to/monitor -F key=DONT_MOVE。DONT_MOVE键/标签用于标识您将监视的文件/文件夹。您可以为要观看的不同文件/文件夹创建不同的标签。
要确保存储这些规则，请附加相同的命令（
auditctl除外）-a always,exit -F arch=b64 -S rename,rmdir,unlink,unlinkat,renameat -F dir =/path/to/folder/to/monitor -F key=DONT_MOVE到/etc/audit/audit.rules文件。为此，您可以使用： sudo echo "-a always,exit -F arch=b64 -S rename,rmdir,unlink,unlinkat,renameat -F dir=/path/to/folder/to/monitor -F键=DONT_MOVE”>> /etc/audit/audit.rules （它说权限被拒绝，因此需要修复）
然后
文件/文件夹丢失，您想知道它的新路径吗？使用
ausearch -k DONT_MOVE（DONT_MOVE或您为要监控的每个文件/文件夹单独选择的任何其他标签）According to @slightly_toasted's answer there, you can use
sudo auditctl -a always,exit -F arch=b64 -S rename,rmdir,unlink,unlinkat,renameat -F dir=/path/to/folder/to/monitor -F key=DONT_MOVE.The
DONT_MOVEkey/tag is what identifies the file/folder you'll be monitoring.You can create different tags to different files/folder you are going to watch.
To ensure that these rules are stored, append the same command (except
auditctl)-a always,exit -F arch=b64 -S rename,rmdir,unlink,unlinkat,renameat -F dir=/path/to/folder/to/monitor -F key=DONT_MOVEto the/etc/audit/audit.rulesfile.For this, you can use:
sudo echo "-a always,exit -F arch=b64 -S rename,rmdir,unlink,unlinkat,renameat -F dir=/path/to/folder/to/monitor -F key=DONT_MOVE" >> /etc/audit/audit.rules(it says permission denied so it need a fix)Then
The file/folder is missing and you want to know its new path? Use
ausearch -k DONT_MOVE(DONT_MOVEor any other tag you chose individually for every file/folder you wanted to monitor)