0

Whenever I replace a binary file in the directory which is added into intoifywait list.I am getting same log multiple time.But for other files like .js etc. It is working fine. Below are logs

monitor_status DELETE 2018-08-12 14:07:54
monitor_status CREATE 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
hello CREATE 2018-08-12 14:09:38
monitor_status DELETE 2018-08-14 07:02:52
monitor_status CREATE 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52

1 Answer 1

0

inotifywait shows every 'write' syscal. In case of simple cp (on my test machine and ext4) it makes modify operations for every 64k:

# dd if=/dev/urandom of=test bs=64K count=1
1+0 records in
1+0 records out
65536 bytes (66 kB) copied, 0.00178826 s, 36.6 MB/s
# cp test test2

gives (copying only):

./ OPEN test
./ MODIFY test2
./ OPEN test2
./ ACCESS test
./ MODIFY test2
./ CLOSE_WRITE,CLOSE test2
./ CLOSE_NOWRITE,CLOSE test

But:

# dd if=/dev/urandom of=test bs=128K count=1
1+0 records in
1+0 records out
131072 bytes (131 kB) copied, 0.00251142 s, 52.2 MB/s
# cp test test2

gives (copying only):

./ OPEN test
./ MODIFY test2
./ OPEN test2
./ ACCESS test
./ MODIFY test2
./ ACCESS test # one more time
./ MODIFY test2 # one more time
./ CLOSE_WRITE,CLOSE test2
./ CLOSE_NOWRITE,CLOSE test

Same thing shown in strace:

# 64k file
open("test", O_RDONLY)                  = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=65536, ...}) = 0
open("test2", O_WRONLY|O_TRUNC)         = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
fadvise64(3, 0, 0, POSIX_FADV_SEQUENTIAL) = 0
read(3, "\374\207\343\36\263\17\224A\361R\271\333\f\1\342\236K\n\270\f\250x}/\346}a\221\237\323\315\32"..., 65536) = 65536
write(4, "\374\207\343\36\263\17\224A\361R\271\333\f\1\342\236K\n\270\f\250x}/\346}a\221\237\323\315\32"..., 65536) = 65536
read(3, "", 65536)                      = 0
close(4)                                = 0
close(3)                                = 0

# 128k file
open("test", O_RDONLY)                  = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=131072, ...}) = 0
open("test2", O_WRONLY|O_TRUNC)         = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
fadvise64(3, 0, 0, POSIX_FADV_SEQUENTIAL) = 0
read(3, "pK;\376\326\17gx\20\227\320\204\7\6:\233r\0\215\215b\r?2\31\206\331\16q\205\324\22"..., 65536) = 65536
write(4, "pK;\376\326\17gx\20\227\320\204\7\6:\233r\0\215\215b\r?2\31\206\331\16q\205\324\22"..., 65536) = 65536
read(3, "\37515X\225\230xL\nhW\"\240\315P]\376\347#\10\341\25\215\212:f9q\313\255\32\n"..., 65536) = 65536
write(4, "\37515X\225\230xL\nhW\"\240\315P]\376\347#\10\341\25\215\212:f9q\313\255\32\n"..., 65536) = 65536
read(3, "", 65536)                      = 0
close(4)                                = 0

I can't say if it depends on filesystem or what, but cp copies files in parts of fixed size (in my case 64k), and when every part is written you can see 'modify' event.

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.