☰

inotifywait 工具在替换二进制文件时同时显示多个日志

tag-icon • tag-icon linux centos
inotifywait 工具在替换二进制文件时同时显示多个日志

每当我替换添加到列表的目录中的二进制文件时。intoifywait我多次获得相同的日志。但对于其他文件，如.js等。它工作正常。以下是日志

monitor_status DELETE 2018-08-12 14:07:54
monitor_status CREATE 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
monitor_status MODIFY 2018-08-12 14:07:54
hello CREATE 2018-08-12 14:09:38
monitor_status DELETE 2018-08-14 07:02:52
monitor_status CREATE 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52
monitor_status MODIFY 2018-08-14 07:02:52

答案1

inotifywait 显示每个“写入”系统。如果是简单的 cp（在我的测试机和 ext4 上），它会为每 64k 进行修改操作：

# dd if=/dev/urandom of=test bs=64K count=1
1+0 records in
1+0 records out
65536 bytes (66 kB) copied, 0.00178826 s, 36.6 MB/s
# cp test test2

给出（仅复制）：

./ OPEN test
./ MODIFY test2
./ OPEN test2
./ ACCESS test
./ MODIFY test2
./ CLOSE_WRITE,CLOSE test2
./ CLOSE_NOWRITE,CLOSE test

但：

# dd if=/dev/urandom of=test bs=128K count=1
1+0 records in
1+0 records out
131072 bytes (131 kB) copied, 0.00251142 s, 52.2 MB/s
# cp test test2

给出（仅复制）：

./ OPEN test
./ MODIFY test2
./ OPEN test2
./ ACCESS test
./ MODIFY test2
./ ACCESS test # one more time
./ MODIFY test2 # one more time
./ CLOSE_WRITE,CLOSE test2
./ CLOSE_NOWRITE,CLOSE test

strace 中显示的内容相同：

# 64k file
open("test", O_RDONLY)                  = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=65536, ...}) = 0
open("test2", O_WRONLY|O_TRUNC)         = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
fadvise64(3, 0, 0, POSIX_FADV_SEQUENTIAL) = 0
read(3, "\374\207\343\36\263\17\224A\361R\271\333\f\1\342\236K\n\270\f\250x}/\346}a\221\237\323\315\32"..., 65536) = 65536
write(4, "\374\207\343\36\263\17\224A\361R\271\333\f\1\342\236K\n\270\f\250x}/\346}a\221\237\323\315\32"..., 65536) = 65536
read(3, "", 65536)                      = 0
close(4)                                = 0
close(3)                                = 0

# 128k file
open("test", O_RDONLY)                  = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=131072, ...}) = 0
open("test2", O_WRONLY|O_TRUNC)         = 4
fstat(4, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
fadvise64(3, 0, 0, POSIX_FADV_SEQUENTIAL) = 0
read(3, "pK;\376\326\17gx\20\227\320\204\7\6:\233r\0\215\215b\r?2\31\206\331\16q\205\324\22"..., 65536) = 65536
write(4, "pK;\376\326\17gx\20\227\320\204\7\6:\233r\0\215\215b\r?2\31\206\331\16q\205\324\22"..., 65536) = 65536
read(3, "\37515X\225\230xL\nhW\"\240\315P]\376\347#\10\341\25\215\212:f9q\313\255\32\n"..., 65536) = 65536
write(4, "\37515X\225\230xL\nhW\"\240\315P]\376\347#\10\341\25\215\212:f9q\313\255\32\n"..., 65536) = 65536
read(3, "", 65536)                      = 0
close(4)                                = 0

我不能说它是否取决于文件系统或什么，但 cp 以固定大小的部分（在我的例子中为 64k）复制文件，并且当每个部分都被写入时，您可以看到“修改”事件。

相关内容