I haven’t done a post in a while so thought it was about time I finished off one of my 22 draft posts.

In this post I would like to mention incron. Simply put incron monitors the file system for events and when they occur it can execute commands that are defined in user or system tables in a similar way to cron.

So how is this useful you might ask, well in my case I wanted a way to monitor a directory of uploaded images on one server and when new ones are added copy them across to another server. But you can do absolutely anything you want with it, like monitor a directory for changes and alert by email of them.

Installing

Under new versions of Debian and Ubuntu you can install it using apt.

sudo apt-get install incron

If your distribution does not support install via package management you can download the source code and compile it yourself from the projects download page.

Configuration

Start by editing the ‘/etc/incron.allow’

sudo vim incron.allow

in this case we are going to allow the user root to use incron. You can allow other users such as your own if you wish using line separated entries.

Add

root

to the file then save and quit.

Really Simple Example

Next we will edit the incrontab itself

sudo incrontab -e

for a simple test add the following

/home/YOURUSERNAME IN_CLOSE_WRITE touch /tmp/incrontest-$#

save and exit.

What this does is when a file is written to your home directory the command `touch /tmp/incrontest-THE FILE NAME YOUR WROTE` is run.

To test it works follow these steps.

cd /home/YOURUSERNAME/
touch alpha
touch delta
cd /tmp/
ls -la incrontest-*

You should see output like

-rw-r--r-- 1 root root 0 2010-09-23 22:54 incrontest-alpha
-rw-r--r-- 1 root root 0 2010-09-23 22:54 incrontest-delta

Debugging

If your not sure if your EVENT is working as you expect you can take advantage of the Wildcards incron offers.

For example if you add

/tmp IN_CLOSE_WRITE echo "$$ $@ $# $% $&"

to your incrontab then go to the /tmp directory and create a new file you should get output like this when you check your ‘/var/log/syslog’ file.

Sep 23 23:13:57 localhost incrond[9787]: (root) CMD (echo "$ /tmp alpha IN_CLOSE_WRITE 8")

Caveats

Just a few warnings of things that caught me out when I started using incron.

  • You Can’t Monitor a Directory More than Once
    If you try and monitor a directory more than once you will get an error similar to

    Sep 23 23:24:02 localhost incrond[9787]: cannot create watch for user root: (16) Device or resource busy

    if you want to monitor a dir for different actions use commas to separate the events e.g. ‘IN_CLOSE_WRITE,IN_DELETE’. Then if needed use the $% wildcard to pass the type of event that triggered the command to your script.

  • Not Recursive
    Currently only the parent directory is watched and no changes in the child directories will trigger an event. This may change in future versions.

Summary

Hopefully in this post I have given you a very quick idea of what incron is capable of.  I could give a load more example of what to do with incron but to be honest its very simple and there are lots of good examples in the man documents so best to check them out. Also see the other links below in the resources section for more details.As usual if you have any questions please do send me an email or leave a comment.

Resources

Share this post

10 Comments

  1. Don

    Hi Mark,
    I believe incron executes one line per file. I have found Ubuntu OS documentation that says “System tables are (by default) located in /etc/incron.d”. Currently, when I use ‘sudo incrontab -e’ it places an auto-named file in /tmp although I don’t see the file. Should I try saving the file to the /etc/incron.d folder. I’d then be worried about now having 2 files on the system that I can’t see. Thanks for any advice.

    • Mark Davidson

      Hi Don,

      Hopefully I’m understanding you right and whats happening is the following. Your editing the incron file as root and therfore the command is being executed as root as a result the files will be owned by that user. Thefore when you go to /tmp as a normal user you won’t see them (depending on how your permissions are set up).
      What you need to do if this is the case is edit the `incron.allow` file and add your own user. Then use `incrontab -e` without the sudo and you can setup the incron for your user. Repeat the testing steps and the files will be owned by your user.

      Hope that all makes sense if it still doesn’t help or if I have the wrong end of the stick please let me know and I’ll have a proper look for you.

      All the best,

      Mark

  2. lemon

    HI Mark,

    when i use incrontab out of the box, i mean no changes,

    i have no result, as if the cmd was not executed.

    my incron line is :
    /crrae IN_CREATE,IN_CLOSE_WRITE,IN_MOVED_TO /usr/bin/unix2dos $#
    the log give information as if everything was ok but no actually

    when i change my incron to :
    /crrae IN_CREATE,IN_CLOSE_WRITE,IN_MOVED_TO /usr/bin/unix2dos /crrae/$#

    the log give me this:
    May 4 18:15:10 srvovs incrond[20859]: (root) CMD (/usr/bin/unix2dos /crrae/u2dtmpPbqoFd)
    May 4 18:15:10 srvovs incrond[20859]: (root) CMD (/usr/bin/unix2dos /crrae/u2dtmpN2Odxf)
    May 4 18:15:10 srvovs incrond[20859]: (root) CMD (/usr/bin/unix2dos /crrae/u2dtmpN2Odxf)

    multiple times

    any idea ?

  3. lemon

    here is also the incron.conf

    [root@srvovs ~]# cat /etc/incron.conf
    #
    # *** incron example configuration file ***
    #
    # (c) Lukas Jelinek, 2007, 2008
    #

    # Parameter: system_table_dir
    # Meaning: system table directory
    # Description: This directory is examined by incrond for system table files.
    # Default: /etc/incron.d
    #
    # Example:
    # system_table_dir = /var/spool/incron.systables

    # Parameter: user_table_dir
    # Meaning: user table directory
    # Description: This directory is examined by incrond for user table files.
    # Default: /var/spool/incron
    #
    # Example:
    # user_table_dir = /var/spool/incron.usertables

    # Parameter: allowed_users
    # Meaning: allowed users list file
    # Description: This file contains users allowed to use incron.
    # Default: /etc/incron.allow
    #
    # Example:
    # allowed_users = /etc/incron/allow

    # Parameter: denied_users
    # Meaning: denied users list file
    # Description: This file contains users denied to use incron.
    # Default: /etc/incron.deny
    #
    # Example:
    # denied_users = /etc/incron/deny

    # Parameter: lockfile_dir
    # Meaning: application lock file directory
    # Description: This directory is used for creating a lock avoiding to run
    # multiple instances of incrond.
    # Default: /var/run
    #
    # Example:
    # lockfile_dir = /tmp

    # Parameter: lockfile_name
    # Meaning: application lock file name base
    # Description: This name (appended by ‘.pid’) is used for creating a lock
    # avoiding to run multiple instances of incrond.
    # Default: incrond
    #
    # Example:
    # lockfile_name = incron.lock

    # Parameter: editor
    # Meaning: editor executable
    # Description: This name or path is used to run as an editor for editting
    # user tables.
    # Default: vim
    #
    # Example:
    # editor = nano

  4. Ninad

    I installed incron but incrontab -e is not running.

    [nshelke~]$ sudo incrontab -e
    editor finished with error: No such file or directory

    • Blackclaw

      This is stupid but your user table must exist (path to the table taken from the sample conf in the comment above yours):
      touch /var/spool/incron.usertables/root

    • docboom

      I had the same problem and it came up because the default editor vim wasn’t installed on my system.

  5. Luis Ramos

    I am having an install issue as seen here
    Resolving Dependencies
    –> Running transaction check
    —> Package incron.x86_64 0:0.5.9-3.2 will be installed
    –> Finished Dependency Resolution

    Dependencies Resolved

    ===========================================================================================================================
    Package Arch Version Repository Size
    ===========================================================================================================================
    Installing:
    incron x86_64 0.5.9-3.2 /incron-0.5.9-3.2.x86_64 228 k

    Transaction Summary
    ===========================================================================================================================
    Install 1 Package(s)

    Total size: 228 k
    Installed size: 228 k
    Is this ok [y/N]: y
    Downloading Packages:
    Running rpm_check_debug
    Running Transaction Test
    Transaction Test Succeeded
    Running Transaction
    Warning: RPMDB altered outside of yum.
    Installing : incron-0.5.9-3.2.x86_64 1/1
    Non-fatal POSTIN scriptlet failure in rpm package incron-0.5.9-3.2.x86_64
    /var/tmp/rpm-tmp.3YVtWG: line 1: fg: no job control
    warning: %post(incron-0.5.9-3.2.x86_64) scriptlet failed, exit status 1
    Installed products updated.

    Installed:
    incron.x86_64 0:0.5.9-3.2

    Complete!

    Do you have any idea how to solved this?

  6. Jerome

    from journalctl -xe (antergos):
    (the last 4 lines… there is a lot more before)

    jun 23 18:28:02 antergos-jerome incrond[3058]: cannot fork process: Resource temporarily unavailable
    jun 23 18:28:02 antergos-jerome incrond[3058]: table for user jerome changed, reloading
    jun 23 18:28:02 antergos-jerome incrond[3058]: access denied on EXECPIPEERROR – events will be discarded silently
    jun 23 18:28:02 antergos-jerome incrond[3058]: cannot create watch for user jerome: (2) No such file or directory

    i check that directories exist (they exist), and mechanism incron working, but why all of these messages all the time polute the journalctl with errors messages ? what should be wrong ?
    I check that i have /var/spool/incron/jerome table (and the table is not empty, have the correct code inside).
    I not find any clue for resolve that.

  7. kingkino

    hi Jerome

    check config file at [/etc/incron.conf] and remove commentout like bellow.

    # Parameter: user_table_dir
    # Meaning: user table directory
    # Description: This directory is examined by incrond for user table files.
    # Default: /var/spool/incron
    #
    # Example:
    user_table_dir = /var/spool/incron.usertables ← here

    next do this command.

    [touch /var/spool/incron.usertables/root “or anything user name”]

    reboot incron.

    sudo /etc/init.d/incrond stop
    sudo /etc/init.d/incrond start

    set commadnn using [incrontab -e]

    I hope if the problem is resolved.

Leave a Reply

CAPTCHA (required) Time limit is exhausted. Please reload CAPTCHA.