fanotify - Linux


fanotify is a powerful Linux command that allows users to monitor file system changes and receive notifications when specific events occur. It provides a robust framework for implementing file system-based events and notifications, enabling developers and system administrators to enhance the functionality and responsiveness of their applications and systems.


fanotify [options] <command> <path...>

    init <objtype>:<flag> <flags>
        Initialize fanotify object
    mark <fd> <objtype>:<flag> <flags>
        Modify fanotify object
    getmark <fd>
        Retrieve mark associated with fanotify object
    watch <fd> <path...>
        Add watched file path to fanotify object
    unwatch <fd> <path...>
        Remove watched file path from fanotify object


  • -v, –version: Display version information.
  • -h, –help: Display a brief help message.
  • -q, –quiet: Suppress error messages.
  • -d, –debug: Enable debug mode.


Initialize a fanotify object:

fanotify init all:modify,open,delete,close /tmp

Mark a fanotify object:

fanotify mark 3 all:readonly,create,unlink

Retrieve the mark associated with a fanotify object:

fanotify getmark 3

Add a watched file path to a fanotify object:

fanotify watch 3 /home/user/documents

Remove a watched file path from a fanotify object:

fanotify unwatch 3 /home/user/documents

Common Issues

  • Permission denied: Ensure that the user running the command has sufficient permissions to monitor the specified file system.
  • File not found: Verify that the specified file or directory exists and is accessible.
  • Invalid arguments: Check the syntax and ensure that all arguments are specified correctly.


fanotify can be combined with other Linux commands, such as inotifywait or tail -f, to create more complex monitoring and notification systems. For example, the following command uses fanotify to monitor file changes and display the changes using tail -f:

fanotify init all:modify,delete,close /tmp | tail -f

Related Commands

  • inotify: Monitors file system events and provides notifications.
  • inotifywait: Waits for file system events and executes a specified command when the event occurs.