Incron 在指定檔案系統發生某些指定變化後運行指定程序，工作類似cron
# yum install -y incron # systemctl enable incrond # systemctl start incrond
相關檔案
# rpm -ql incron-0.5.10-8.el7 /etc/incron.conf /etc/incron.d /usr/bin/incrontab /usr/lib/systemd/system/incrond.service /usr/sbin/incrond /usr/share/doc/incron-0.5.10 /usr/share/doc/incron-0.5.10/CHANGELOG /usr/share/doc/incron-0.5.10/COPYING /usr/share/doc/incron-0.5.10/LICENSE-GPL /usr/share/doc/incron-0.5.10/README /usr/share/doc/incron-0.5.10/TODO /usr/share/man/man1/incrontab.1.gz /usr/share/man/man5/incron.conf.5.gz /usr/share/man/man5/incrontab.5.gz /usr/share/man/man8/incrond.8.gz /var/spool/incron
incrontab用法語crontab極其類似。
配置觸發事件,格式如下：
<path> <mask> <command>
[root@localhost ~]# incrontab -e /etc IN_MODIFY /tmp/test.sh $@/$#
查看觸發事件
# incrontab -l /etc IN_MODIFY /tmp/test.sh $@/$#
測試腳本
# cat /tmp/test.sh #!/bin/bash echo $@ >> /tmp/test.log
現在你可以修改/etc下面的檔案，然後查看/tmp/test.log日誌的變化。
IN_ACCESS File was accessed (read) (*) IN_ATTRIB Metadata changed (permissions, timestamps, extended attributes, etc.) (*) IN_CLOSE_WRITE File opened for writing was closed (*) IN_CLOSE_NOWRITE File not opened for writing was closed (*) IN_CREATE File/directory created in watched directory (*) IN_DELETE File/directory deleted from watched directory (*) IN_DELETE_SELF Watched file/directory was itself deleted IN_MODIFY File was modified (*) IN_MOVE_SELF Watched file/directory was itself moved IN_MOVED_FROM File moved out of watched directory (*) IN_MOVED_TO File moved into watched directory (*) IN_OPEN File was opened (*) IN_ALL_EVENTS all of the above events IN_MOVE a combination of IN_MOVED_FROM and IN_MOVED_TO IN_CLOSE combines IN_CLOSE_WRITE and IN_CLOSE_NOWRITE. IN_DONT_FOLLOW Don't dereference pathname if it is a symbolic link IN_ONESHOT Monitor pathname for only one event IN_ONLYDIR Only watch pathname if it is a directory