linux fanotify和inotify

工作中用到fanotify和inotify，记录下
Fanotify 有三个个基本的模式：directed，per-mount 和 global。其中，directed 模式和 inotify 类似，直接工作在被监控的对象的 inode 上，一次只可以监控一个对象。因此需要监控大量目标时也很麻烦。Global 模式则监控整个文件系统，任何变化都会通知 Listener。Per-mount 模式工作在 mount 点上，比如磁盘 /dev/sda2 的 mount 点在 /home，则 /home 目录下的所有文件系统变化都可以被监控，这其实可以被看作另外一种 Global 模式。
fanotify能监控的类型比inotify少
fanotify可以返回进程pid
fanotify需要root权限

fanotify

#define _GNU_SOURCE    
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <poll.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/fanotify.h>
#include <unistd.h>
#include <time.h>
#include <string>
#include <set>
using namespace std;

set<string> sset;


static void handle_events(int fd)
{
    const struct fanotify_event_metadata *metadata;
    struct fanotify_event_metadata buf[200];
    ssize_t len;
    char path[PATH_MAX];
    ssize_t path_len;
    char procfd_path[PATH_MAX];
    struct fanotify_response response;


    for(;;) 
    {

        len = read(fd, (void *) &buf, sizeof(buf));
        if (len == -1 && errno != EAGAIN) 
        {
            perror("read");
            exit(EXIT_FAILURE);
        }
        
        if (len <= 0)
            continue;
        
        metadata = buf;


        while (FAN_EVENT_OK(metadata, len)) 
        {
            if (metadata->vers != FANOTIFY_METADATA_VERSION) 
            {
                fprintf(stderr,"Mismatch of fanotify metadata version.\n");
                continue;
            }

            //printf ("receive event time %llu \n",time(NULL));
            if (metadata->fd >= 0) 
            {
                if ((metadata->mask & FAN_MODIFY) || (metadata->mask & FAN_OPEN))
                {
                    
                    snprintf(procfd_path, sizeof(procfd_path),
                            "/proc/self/fd/%d", metadata->fd);
                    path_len = readlink(procfd_path, path,
                                        sizeof(path) - 1);
                    if (path_len == -1) {
                        perror("readlink");
                        exit(EXIT_FAILURE);
                    }

                    path[path_len] = '\0';
                    string Path = path;
                    if (sset.find(Path) != sset.end())
                    {
                        printf("receive: %d\n", metadata->mask);
                        if (metadata->mask & FAN_MODIFY)
                            printf("FAN_MODIFY: \n");
                        if (metadata->mask & FAN_OPEN)
                            printf("FAN_open: \n");
                        printf("PID  %d op File %s\n",metadata->pid , path);
                    }
                    
                }
                
                close(metadata->fd); 
            }

            /* Advance to next event */

            metadata = FAN_EVENT_NEXT(metadata, len);
        }
    }
}

int main(int argc, char *argv[])
{
    char buf;
    int fd, poll_num;
    nfds_t nfds;
    struct pollfd fds[2];
    sset.insert(string("/home/zxdbtest/data/data/py/py.ibd"));
    /* Check mount point is supplied */

    if (argc < 2) 
    {
        exit(EXIT_FAILURE);
    }

    printf("FAN_MODIFY: %d\n", FAN_MODIFY);
    printf("FAN_open: %d\n", FAN_OPEN);
    //FAN_NONBLOCK 是非阻塞  read时不阻塞，导致cpu占用过高，不建议设置
    fd = fanotify_init(FAN_CLOEXEC | FAN_CLASS_CONTENT |FAN_NONBLOCK,
                        O_RDONLY | O_LARGEFILE);
    if (fd == -1) 
    {
        perror("fanotify_init");
        exit(EXIT_FAILURE);
    }
    for (int i=1;i<argc;i++)
    {
        printf("add watch : %s\n",argv[i] );
        //FAN_MARK_MOUNT 是监控挂载点
        if (fanotify_mark(fd, FAN_MARK_ADD|FAN_MARK_MOUNT  ,FAN_MODIFY | FAN_OPEN, -1,argv[i]) == -1) 
        {
            perror("fanotify_mark");
            exit(EXIT_FAILURE);
        }
    }
    handle_events(fd);
    printf("Listening for events stopped.\n");
    exit(EXIT_SUCCESS);
}

inotify

#include<stdio.h>
#include<assert.h>
#include<unistd.h>
#include<stdlib.h>
#include<errno.h>
#include<string.h>
#include<sys/types.h>
#include<sys/inotify.h>
#include<limits.h>
#include<fcntl.h>
#include<sys/ioctl.h>
#include<sys/time.h>

#define BUF_LEN 1000


/*
struct inotify_event {
   int      wd;       // Watch descriptor 
   uint32_t mask;     // Mask of events 
   uint32_t cookie;   // Unique cookie associating related  events (for rename(2))
   uint32_t len;      // Size of name field 
   char     name[];   // Optional null-terminated name 
};
*/

//若不将inotify的文件符加入到 select中  删除自身（直接监控file）不会被捕捉到
int event_check (int fd)
{
    fd_set rfds;
    FD_ZERO (&rfds);
    FD_SET (fd, &rfds);
    //timeout=NULL（阻塞：select将一直被阻塞，直到某个文件描述符上发生了事件）
    return select (fd+1, &rfds, NULL, NULL, NULL);//第一个参数是加入的fd最大值加一
}

void handleInotifyEvents(int inotifyFd, fd_set &inputs)
{
    struct inotify_event *event;
    char *p;
    char buf[BUF_LEN];
    ssize_t numRead;
    fd_set testfds;
    for(;;)  
    {
        if (event_check (inotifyFd) > 0)
        {
            numRead = read(inotifyFd,buf,BUF_LEN);
            if(numRead == -1)
            {
                printf("read error\n");
            }

            printf("read %ld bytes from inotify fd\n",(long)numRead);
            for(p = buf; p < buf+numRead;)
            {
                event = (struct inotify_event *)p;
                if(event ->mask & IN_DELETE_SELF)  //判断是那个文件进行了更改
                {
                    printf(" %s IN_DELETE_SELF\n",event->name);//这里name一般为空，所以使用时一般要提前保存好
                }
                p += sizeof(struct inotify_event)+ event->len;
            }
        }
    } 
}

int main(int argc,char **argv)
{
    int inotifyFd;  
    fd_set inputs;
    
    if(argc < 2)
    {
        printf("error\n");
    }

    inotifyFd = inotify_init(); //系统调用可创建一新的inotify实例  初始化实例
    if(inotifyFd == -1)
    {
        printf("init error\n");
        return 0;
    }
    for (int i=1;i<argc;i++)
    {
        printf("add watch : %s\n",argv[i] );
        int wd = inotify_add_watch(inotifyFd,argv[i],IN_DELETE_SELF);  //系统调用inotify_add_watch()可以追加新的监控项
        if(wd < 0)
        {
            printf("add watch error \n");
        }
        printf("watching %s using wd =  %d\n", argv[i], wd);
    }
    
    handleInotifyEvents(inotifyFd, inputs);
    close(inotifyFd);
    return 0;
}