Inotify2(3pm)

🦋 NAME 🦋

Linux::Inotify2 — scalable directory/file change notification.

okay hi bestie 💖 so this is the Inotify2(3pm) page (it lives in the User Contributed Perl Documentation section, if you were curious) and listen, it's a long one, so it's been split into two parts. We're doing part one right now. Stay with me. 🫶

It's a Perl module that watches your files and folders and yells at you the second anything changes about them. Which is iconic, honestly.

---

✨ SYNOPSIS ✨

Two whole ways to drive this thing. Pick your fighter 🌸

🌈 Callback Interface

use Linux::Inotify2;

# create a new object
my $inotify = new Linux::Inotify2
   or die "unable to create new inotify object: $!";

# add watchers
$inotify->watch ("/etc/passwd", IN_ACCESS, sub {
   my $e = shift;
   my $name = $e->fullname;
   print "$name was accessed\n" if $e->IN_ACCESS;
   print "$name is no longer mounted\n" if $e->IN_UNMOUNT;
   print "$name is gone\n" if $e->IN_IGNORED;
   print "events for $name have been lost\n" if $e->IN_Q_OVERFLOW;

   # cancel this watcher: remove no further events
   $e->w->cancel;
});

# integration into AnyEvent (works with EV, Glib, Tk, POE...)
my $inotify_w = AE::io $inotify->fileno, 0, sub { $inotify->poll };

# manual event loop
$inotify->poll while 1;

🌟 Streaming Interface

use Linux::Inotify2;

# create a new object
my $inotify = new Linux::Inotify2
   or die "Unable to create new inotify object: $!";

# create watch
$inotify->watch ("/etc/passwd", IN_ACCESS)
   or die "watch creation failed";

while () {
  my @events = $inotify->read;
  printf "mask\t%d\n", $_->mask foreach @events;
}

---

💖 DESCRIPTION 💖

So this module is a whole interface to the Linux 2.6.13 and later Inotify file/directory change notification system. Yes, the kernel's own thing. We're just driving it from Perl. 💅

It's got some serious advantages over the Linux::Inotify module, and I'm gonna list them because the original did:

• it is portable (Linux::Inotify only works on x86) — not me being shady, that's just facts
• the equivalent of fullname works correctly ✨
• it is better documented 📚
• it has callback-style interface, which is better suited for integration

And as for the inotify API itself — okay bestie, real talk: it is a very tricky, and somewhat unreliable API. 😭 For a good overview of the challenges you might run into, see this LWN article: https://lwn.net/Articles/605128/

---

👑 The Linux::Inotify2 Class

my $inotify = new Linux::Inotify2

Create a new notify object and return it. Think of a notify object as a little container 📦 that stores watches on file system names and is responsible for handling event data.

On error, undef is returned and $! will be set accordingly. The following errors are documented:

• ENFILE — The system limit on the total number of file descriptors has been reached.
• EMFILE — The user limit on the total number of inotify instances has been reached.
• ENOMEM — Insufficient kernel memory is available.

Example:

my $inotify = new Linux::Inotify2
   or die "Unable to create new inotify object: $!";

$watch = $inotify->watch ($name, $mask[, $cb])

Add a new watcher to the given notifier. The watcher will create events on the pathname $name as given in $mask, which can be any of the following constants (all exported by default) ORed together. Constants unavailable on your system will evaluate to 0.

Heads up on the vocab, because the original is very specific about this 🎀 — "file" refers to any file system object in the watched object (always a directory), that is files, directories, symlinks, device nodes etc., while "object" refers to the object the watcher has been set on itself:

• IN_ACCESS — object was accessed
• IN_MODIFY — object was modified
• IN_ATTRIB — object metadata changed
• IN_CLOSE_WRITE — writable fd to file / to object was closed
• IN_CLOSE_NOWRITE — readonly fd to file / to object closed
• IN_OPEN — object was opened
• IN_MOVED_FROM — file was moved from this object (directory)
• IN_MOVED_TO — file was moved to this object (directory)
• IN_CREATE — file was created in this object (directory)
• IN_DELETE — file was deleted from this object (directory)
• IN_DELETE_SELF — object itself was deleted
• IN_MOVE_SELF — object itself was moved
• IN_ALL_EVENTS — all of the above events

and then these ✨

• IN_ONESHOT — only send event once
• IN_ONLYDIR — only watch the path if it is a directory
• IN_DONT_FOLLOW — don't follow a sym link (Linux 2.6.15+)
• IN_EXCL_UNLINK — don't create events for unlinked objects (Linux 2.6.36+)
• IN_MASK_ADD — not supported with the current version of this module 🙈

plus two lil shortcut combos:

• IN_CLOSE — same as IN_CLOSE_WRITE | IN_CLOSE_NOWRITE
• IN_MOVE — same as IN_MOVED_FROM | IN_MOVED_TO

$cb is a perl code reference that, if given, is called for each event. It receives a Linux::Inotify2::Event object.

The returned $watch object is of class Linux::Inotify2::Watch.

On error, undef is returned and $! will be set accordingly. The following errors are documented:

• EBADF — The given file descriptor is not valid.
• EINVAL — The given event mask contains no legal events.
• ENOMEM — Insufficient kernel memory was available.
• ENOSPC — The user limit on the total number of inotify watches was reached or the kernel failed to allocate a needed resource.
• EACCESS — Read access to the given file is not permitted.

Example, show when /etc/passwd gets accessed and/or modified once:

$inotify->watch ("/etc/passwd", IN_ACCESS | IN_MODIFY, sub {
   my $e = shift;
   print "$e->{w}{name} was accessed\n" if $e->IN_ACCESS;
   print "$e->{w}{name} was modified\n" if $e->IN_MODIFY;
   print "$e->{w}{name} is no longer mounted\n" if $e->IN_UNMOUNT;
   print "events for $e->{w}{name} have been lost\n" if $e->IN_Q_OVERFLOW;

   $e->w->cancel;
});

$inotify->fileno

Returns the file descriptor for this notify object. When in non-blocking mode, you are responsible for calling the poll method when this file descriptor becomes ready for reading. 👀

$inotify->fh

Similar to fileno, but returns a perl file handle instead. 🎀

$inotify->blocking ($blocking)

Clears ($blocking true) or sets ($blocking false) the O_NONBLOCK flag on the file descriptor.

$count = $inotify->poll

Reads events from the kernel and handles them. If the notify file descriptor is blocking (the default), then this method waits for at least one event. Otherwise it returns immediately when no pending events could be read.

Returns the count of events that have been handled — which can be 0 in case events have been received but have been ignored or handled internally.

Croaks when an error occurs. 😤

@events = $inotify->read

Reads events from the kernel. Blocks when the file descriptor is in blocking mode (default) until any event arrives. Returns list of Linux::Inotify2::Event objects or empty list if none (non-blocking mode or events got ignored).

Croaks on error.

Normally you shouldn't use this function, but instead use watcher callbacks and call ->poll. fr fr, use the callbacks.

$inotify->on_overflow ($cb->($ev))

Sets the callback to be used for overflow handling (default: undef): When read receives an event with IN_Q_OVERFLOW set, it will invoke this callback with the event.

When the callback is undef, then it broadcasts the event to all registered watchers, i.e., undef is equivalent to:

sub { $inotify->broadcast ($_[0]) }

$inotify->broadcast ($ev)

Invokes all registered watcher callbacks and passes the given event to them. Most useful in overflow handlers. 💅

---

🦋 The Linux::Inotify2::Event Class

Objects of this class are handed as first argument to the watcher callback. It has the following members and methods:

$event->w / $event->{w}

The watcher object for this event, if one is available. Generally, you can only rely on the value of this member inside watcher callbacks.

$event->name / $event->{name}

The path of the file system object, relative to the watched name.

$event->fullname

Returns the "full" name of the relevant object — i.e. including the name member of the watcher (if the watch object is on a directory and a directory entry is affected), or simply the name member itself when the object is the watch object itself.

This call requires $event->{w} to be valid, which is generally only the case within watcher callbacks. ⚠️

$event->mask / $event->{mask}

The received event mask. In addition to the events described for $inotify->watch, the following flags (exported by default) can be set:

• IN_ISDIR — event object is a directory
• IN_Q_OVERFLOW — event queue overflowed

and then this whole group, where the watchers go bye-bye automatically:

# when any of the following flags are set,
# then watchers for this event are automatically canceled

• IN_UNMOUNT — filesystem for watched object was unmounted
• IN_IGNORED — file was ignored/is gone (no more events are delivered)
• IN_ONESHOT — only one event was generated
• IN_Q_OVERFLOW — queue overflow - event might not be specific to a watcher

$event->IN_xxx

Returns a boolean that returns true if the event mask contains any events specified by the mask. All of the IN_xxx constants can be used as methods. 🌈

$event->cookie / $event->{cookie}

The event cookie to "synchronize two events". Normally zero, this value is set when two events relating to the same file are generated. As far as I know, this only happens for IN_MOVED_FROM and IN_MOVED_TO events, to identify the old and new name of a file.

Note that the inotify API makes it impossible to know whether there will be a IN_MOVED_TO event — you might receive only one of the events, and even if you receive both, there might be any number of events in between. The best approach seems to be to implement a small timeout after IN_MOVED_FROM to see if a matching IN_MOVED_TO event will be received — 2ms seem to work relatively well. 😭 (this is the "unreliable API" part I warned you about)

---

💜 The Linux::Inotify2::Watch Class

Watcher objects are created by calling the watch method of a notifier.

It has the following members and methods:

$watch->name / $watch->{name}

The name as specified in the watch call. For the object itself, this is the empty string. For directory watches, this is the name of the entry without leading path elements.

$watch->mask / $watch->{mask}

The mask as specified in the watch call.

$watch->cb ([new callback]) / $watch->{cb}

The callback as specified in the watch call. Can optionally be changed. 🔄

$watch->cancel

Cancels/removes this watcher. Future events, even if already queued, will not be handled and resources will be freed. 💅

---

🌸 SEE ALSO 🌸

AnyEvent, Linux::Inotify.

👑 AUTHOR 👑

Okay so this whole thing was cooked up by Marc Lehmann — the actual main character who wrote Inotify2 and decided we all deserved nice asynchronous inotify vibes. Show some respect, bestie 💅

• Creator & maintainer: Marc Lehmann <schmorp@schmorp.de>
• Home base on the interwebs: http://home.schmorp.de/

Like, if you found a bug, wanna say thanks, or just have thoughts — that email is right there, so use it. Fr fr. 🫶

---

And that's a wrap on the whole page, angels ✨ This beauty lives in perl v5.42.3 and it was last touched on 2026-08-20. Go forth and inotify with main character energy 👑🌸🦋