incrontab(5)						       incron documentation						      incrontab(5)

NAME

       incrontab - tables for driving inotify cron (incron)

DESCRIPTION

       An  incrontab  file  contains instructions to the incrond(8) daemon of the general form: "run this command on these file events". There are
       two categories of tables: system tables (with root privileges) and user tables (with user privileges).

       System tables are (by default) located in /etc/incron.d and may have any names. Each system table exists separately inside incron and their
       watches never collide.

       Each  user has their own table, and commands in any given incrontab will be executed as the user who owns the incrontab. System users (such
       as apache, postfix, nobody etc.) may have their own incrontab.

       incrontab files are read when the incrond(8) daemon starts and after any change (incrontab file are being hooked when incrond is running).

       Blank lines are ignored. The general line format is the following:

       <path> <mask> <command>

       Where path is an absolute filesystem path, mask is an event mask (in symbolic or numeric form) and command is  an  executable  file  (or  a
       script)	with  its  arguments.  See bellow for event mask symbols. The executable file may be noted as an absolute path or only as the name
       itself (PATH locations are examined).

       Please remember that the same path may occur only once per table (otherwise only the first occurrence takes effect and an error message	is
       emitted to the system log).

EVENT SYMBOLS

       These basic event mask symbols are defined:

       IN_ACCESS	   File was accessed (read) (*)
       IN_ATTRIB	   Metadata changed (permissions, timestamps, extended attributes, etc.) (*)
       IN_CLOSE_WRITE	   File opened for writing was closed (*)
       IN_CLOSE_NOWRITE    File not opened for writing was closed (*)
       IN_CREATE	   File/directory created in watched directory (*)
       IN_DELETE	   File/directory deleted from watched directory (*)
       IN_DELETE_SELF		Watched file/directory was itself deleted
       IN_MODIFY	   File was modified (*)
       IN_MOVE_SELF	   Watched file/directory was itself moved
       IN_MOVED_FROM	   File moved out of watched directory (*)
       IN_MOVED_TO	   File moved into watched directory (*)
       IN_OPEN		   File was opened (*)

       When  monitoring  a  directory,	the  events marked with an asterisk (*) above can occur for files in the directory, in which case the name
       field in the returned event data identifies the name of the file within the directory.

       The IN_ALL_EVENTS symbol is defined as a bit mask of all of the above events. Two additional convenience symbols are IN_MOVE,  which  is  a
       combination of IN_MOVED_FROM and IN_MOVED_TO, and IN_CLOSE which combines IN_CLOSE_WRITE and IN_CLOSE_NOWRITE.

       The following further symbols can be specified in the mask:

       IN_DONT_FOLLOW	   Don't dereference pathname if it is a symbolic link
       IN_ONESHOT	   Monitor pathname for only one event
       IN_ONLYDIR	   Only watch pathname if it is a directory

       Additionally,  there  is  a symbol which doesn't appear in the inotify symbol set. It it IN_NO_LOOP. This symbol disables monitoring events
       until the current one is completely handled (until its child process exits).

WILDCARDS

       The following wildards may be used inside command specification:

       $$   dollar sign
       $@   watched filesystem path (see above)
       $#   event-related file name
       $%   event flags (textually)
       $&   event flags (numerically)

EXAMPLE

       These are some example rules which can be used in an incrontab file:

       /tmp IN_ALL_EVENTS abcd $@/$# $%

       /usr/bin IN_ACCESS,IN_NO_LOOP abcd $#

       /home IN_CREATE /usr/local/bin/abcd $#

       /var/log 12 abcd $@/$#

       The first line monitors all events on the /tmp directory. When an event occurs it runs a application called 'abcd' with the  full  path	of
       the file as the first arguments and the event flags as the second one.

       The  second  line  monitors  accesses  (readings) on the /usr/bin directory. The application 'abcd' is run as a handler and the appropriate
       event watch is disabled until the program finishes. The file name (without the directory path) is passed in as an argument.

       The third example is used for monitoring the /home directory for newly create files or directories (it practically means an event  is  sent
       when a new user is added). This event is processed by a program specified by an absolute path.

       And   the   final   line  shows	how  to  use  numeric  event  mask  instead  of  textual  one.	The  value  12	is  exactly  the  same	as
       IN_ATTRIB,IN_CLOSE_WRITE.

SEE ALSO

       incrond(8), incrontab(1), incron.conf(5)

AUTHOR

       Lukas Jelinek <lukas@aiken.cz> (please report bugs to http://bts.aiken.cz or <bugs@aiken.cz>).

COPYING

       This program is free software. It can be used, redistributed and/or modified under the terms of the GNU General Public License, version 2.

Lukas Jelinek							      0.5.10							      incrontab(5)