Is there anything like inotify on Windows?

Question

With the Linux OS, there is the inotify subsystem which notifies an application of changes to the filesystem.

However, I am mainly a Windows user, so I was wondering if there is a similar way to monitor filesystem changes?

Substantialism

I don't think such questions are off topic. The question asks for an OS API which is much different any tool/software-library. May be it can be worded differently like how to get notified in a windows application when particular file/files are modified. – Fronton

Voted to reopen: The question is asking for a comparable alternative to a specific operating system API and figuatively reads to me like "I am from England where I use a fork to eat food, in Japan what utensil do I use in a similar fashion?" The accepted answer using that analogy is "use chopsticks." – Spinet

Answer 1

See the FindFirstChangeNotification API, or the .NET counterpart FileSystemWatcher

Nevadanevai

Answer 2

If you're using .net, use FileSystemWatcher. More info here: http://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher.aspx

If you're using C, use FindFirstChangeNotification, FindNextChangeNotification, ReadDirectoryChangesW. More info here: http://msdn.microsoft.com/en-us/library/aa365261(VS.85).aspx

On OSX, the relevant api is the fsevents api.

They're all subtly different from one another, and they all have questionable reliability in edge cases. In general, you can't depend on these apis for a complete view of all changes 100% of the time. Most people using file system monitoring combine it with periodic scans to compensate for lost or incomplete information from the push api.

Depredation

Can you please give some citation on the "questionable reliability in edge case for inotify? – Mcinnis

If a consumer of a fs watcher api is slower at reading events than some other process is at generating them, the kernel either needs to hold up filesystem modifications in the other (possibly higher priority) process, or allow for unlimited growth of the buffer. inotify's buffer depth (as documented in the man page) is controlled by /proc/sys/fs/inotify/max_queued_events. Beyond this, you get a IN_Q_OVERFLOW notification--this is good, but you're still left in a situation where you may need to rescan from time to time. – Depredation

Aha right, I was recently reading up on the queue. I think this edge case would depend on how many files you are monitoring and it also depends on if its critical to track all changes or if a few can be missed. But that's a good point. Thanks :) – Mcinnis

@Depredation I was wonderying myself how kernel people solve these situations. Good to know they do this, makes one more confident in design and implementation. – Canova

Answer 3

take a look at this: inotify-win, a port of the inotifywait tool for Windows

and also this: inotify-tools, a C library and a set of command-line programs providing a simple interface to inotify

Dormancy

Answer 4

JNotify or FileMon from Microsoft.

Embryonic

JNotify was perfect for me because I needed cross-platform compatibility. I was even able to write a single bash script which worked in cygwin, mac, and linux presuming only that JAVA_HOME was set correctly. This has been a great aid for debugging problems on customer's machines, when they say "it deleted my file!" I can actually look at the log and try to figure out how/when that happened. – Afraid

FileMon is now ProcessMonitor technet.microsoft.com/en-us/sysinternals/bb896645 – Ambrosius

Answer 5

A bit late but ...

Windows has a facility similar to OSX events whereby you can monitor events without running an app. The Windows USN Journal keeps track of all file changes. Jeffrey Richter (author of Advanced Windows) wrote a terrific article with working samples for MSDN Journal. Update: article now from archive.org since MSJ no longer online at MS.

MSDN documentation for USN Change Journals.

USN Change Journals are probably better if you're building applications like backup tools or indexes that need to monitor entire volumes.

Poem

Is the USN Journal way any different, does relying on it avoid the buggy behavior of FileSystemWatcher|FindFirstChangeNotification PhillipBrandonHolmes was speaking of? – Canova

It's been a while since I worked with this, but it does not use FileSystemWatcher or FindFirstChangeNotification. I started writing a Windows event watcher in Go, based heavily on Jeffery Richter's examples. From the bit of testing I did, it is rock solid, and misses nothing, similar to fsevents in OS X. Gist is here: gist.github.com/pkrnjevic/7219861 – Poem

@PeterKrnjevic Can you update the link for the article from Jeffrey Richter ? – Arsonist

@SOUser, due to MS bitrot, article is now linked from archive.org. – Poem

Answer 6

FileSystemWatcher() is unreliable mainly due to the fact it's error handling for the watcher buffer is more or less incomplete. Due to a lack of path and detailed error handling information, Microsoft gives you no way to recover or manually poll the working directory.

The JNotify for Windows is unreliable as well because this bug ^ derives from win32. JNotify uses win32. So, it's no different than FileSystemWatcher().

Lek

thinking about how to design roles to solve this 'speed'/'race'/'overflow'-like problem, I wondered myself how the kernels did it. Interesting. This thing also occurs with networking and logging. Does this problem have a name? – Canova

Yes it's name is "bug". The bug (win32) has been left in every operating system created by Microsoft to date. This makes any Microsoft operating system unfit for a file watching type solution. You have to go *nix to accomplish it. Sometimes I think they've intentionally left this buffer overflow in for security reasons. – Lek

haha.. yeah.. it's name is intentional cluster kludge so that microsoft's file system can't be intentionally watched. It's a bug they left in due to security concerns. – Lek

Answer 7

I did a bit of searching, I seem to recall seeing something similar for Windows. There's FileSystemWatcher for .NET. Its mainly for NT or XP and forward.

Mcinnis

It's more generally only available on NTFS Filesystems, but not on FAT16, FAT32 or even the new exFAT. – Broadus

Answer 8

try Java File Notification Library

Intoxicative