GNU Direvent (split by chapter):   Section:   Chapter:FastBack: Configuration   Up: Top   FastForward: Reporting Bugs   Contents: Table of ContentsIndex: Concept Index

6 System Dependencies

Direvent relies on the event monitoring API provided by the kernel.

6.1 GNU/Linux systems.

On GNU/Linux the program uses inotify. See monitoring file system events in inotify(7) man page.

The maximum number of watches a user process can have is controlled by the ‘fs.inotify.max_user_watches’ system variable. Normally it is set to 8192, which is quite enough for most purposes. However, if you monitor a big number or directories and/or are using recursive watchers, you may need to increase this number. In that case, use sysctl (see configure kernel parameters at runtime in sysctl(8) man page) to raise the limit, e.g.:

sysctl -w fs.inotify.max_user_watches=16384

Most GNU/Linux distributions provide the file /etc/sysctl.conf which can be used to set this variable on startup.

The following system-dependent events are defined on systems that use inotify:


A file was accessed.


A file’s metadata changed.


A writable file was closed.


An unwritable file closed.


A file was created.


A file was deleted.


A file was modified.


A file was moved into a monitored directory.


A file was moved out from a monitored directory.


A file was opened.

6.2 BSD systems

When compiled on BSD systems (including Darwin), direvent uses kqueue (see kernel event notification mechanism in kqueue(2) man page).

This interface needs an open file handle for each file in a monitored directory, which means that the number of watchers is limited by the maximum number of open files. Use ‘ulimit -n NUM’ in order to raise it to a higher number.

Since it operates on files, kqueue does not provide direct support for the ‘create’ generic event. Direvent works over this disadvantage by keeping track of the contents of each monitored directory and rescanning it each time a ‘WRITE’ system event is reported for it. It then generates the ‘open’ event for each file that appeared after the last scan. Such a rescan can consume considerable time if a directory has a very large number of files in it.

The following system-dependent events are available:


The unlink() system call was called on the monitored file.


A write occurred on the file.


The file was extended.


The file attributes have changed.


The link count on the file changed.


The file was renamed.


Access to the file was revoked via revoke() (see revoke file access in revoke(2) man page) or the underlying file system was unmounted.

6.3 Darwin (Mac OS X)

Essentially the same as BSD. The main difference compared to Linux and BSD is that on Darwin the watchers are set after disconnecting from the controlling terminal, because Darwin lacks the rfork call and the event queue cannot be inherited by the child process.

GNU Direvent (split by chapter):   Section:   Chapter:FastBack: System dependencies   Up: System dependencies   FastForward: Reporting Bugs   Contents: Table of ContentsIndex: Concept Index