{
  "slug": "inotify",
  "term": "inotify",
  "aliases": [
    "Linux filesystem event notification"
  ],
  "definition": "inotify is a Linux interface that queues selected filesystem notifications for explicitly watched files or directories.",
  "note": "Observation limits: mapped changes can occur without modification events, and directory watches do not recursively cover subdirectories. An unread sequence of identical events can coalesce, so event counts are not operation counts. Queue overflow requires recovery of potentially stale application state. [inotify-api]\n\nWritable closure: IN_CLOSE_WRITE identifies a close associated with write access, not a byte comparison. The Linux v6.8 fsnotify_close hook selects the event from FMODE_WRITE. [close-hook]\n\nMeasured controls: Hesela observed one event for 32 unread pwrite notifications, but 32 when reading the queue after each call. Shared mapped stores changed the file without IN_MODIFY; closing an unchanged writable file still produced IN_CLOSE_WRITE. These one-host checks are not a backup-product evaluation. [hesela-inotify]",
  "status": "shipping",
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-19",
  "advantages": [
    "Can trigger inspection of selected files without repeatedly scanning every path."
  ],
  "limitations": [
    "A notification stream alone does not establish complete or application-consistent backup capture."
  ],
  "related": [
    "memory-mapped-file",
    "incremental-backup",
    "backup-verification",
    "snapshot"
  ],
  "citations": [
    {
      "id": "inotify-api",
      "title": "Linux man-pages 6.19: inotify(7)",
      "url": "https://man7.org/linux/man-pages/man7/inotify.7.html",
      "accessed": "2026-10-19"
    },
    {
      "id": "close-hook",
      "title": "Linux v6.8: fsnotify_close in include/linux/fsnotify.h",
      "url": "https://github.com/torvalds/linux/blob/v6.8/include/linux/fsnotify.h",
      "accessed": "2026-10-19"
    },
    {
      "id": "hesela-inotify",
      "title": "Hesela: What inotify misses: mapped writes and collapsed change events",
      "url": "https://hesela.com/analyses/inotify-change-detection/",
      "accessed": "2026-10-19"
    }
  ],
  "provenance": [
    "API documentation and controlled observations; not a durable change journal or an event-loss rate estimate."
  ]
}