See how inotifywatch counts filesystem events so you can detect changes without polling. 14.06.2026 | reading time: 2 min inotifywatch is a small tool that uses the Linux inotify API to count filesystem events over a short period of time; it helps spot which files changed and how often without writing a custom program. Quick hands-on Run the watcher in one shell and perform file operations in another to see counts collected; for example run this and then create, modify and delete a file during the timeout: ``` inotifywatch -t 6 -r -e create,modify,delete /tmp/inotify-demo mkdir -p /tmp/inotify-demo touch /tmp/inotify-demo/file1.txt echo hello > /tmp/inotify-demo/file1.txt rm /tmp/inotify-demo/file1.txt ``` After the timeout inotifywatch prints a concise summary showing which watched paths received which events, for example: ``` /tmp/inotify-demo/file1.txt create=1 modify=1 delete=1 /tmp/inotify-demo create=1 Total events: 4 ``` More options and practical uses Use `-t` to control how long to collect data, `-r` to recurse into subdirectories, and `-e` to limit event types; common uses are detecting mass deletions, validating deployment scripts, building simple change-audits, and feeding the summary into scripts that trigger backups or alerts. When to reach for others For per-event real-time handling prefer `inotifywait`, for system-wide security auditing use `auditd` or `fanotify`, and for integration with system services consider `systemd.path`; combine tools depending on whether you need summaries, immediate actions, or kernel-level audit logs. Keep watching and learning inotifywatch is a quick way to quantify filesystem activity and narrow down where to focus deeper monitoring or automation; try it in small experiments and then expand into scripted checks or larger audit setups to catch subtle problems early. Join Bits & Bytes Academy First class LINUX exam preparation. filesystem utilities scripting troubleshooting
