1

I want to get notified whenever data on hard disk / hard disk partition gets modified. I am on Linux and want it to check from C++.

My approach was to use inotify on linux device file /dev/sdX (sdX = appropriate hard disk / disk partition file). I wrote program for /dev/sda1 file. My expectation was that whenever I create/delete a file/folder anywhere in home directory, the file /dev/sda1 should dynamically get modified (since my /dev/sda1 is mounted at location "/") and I should get notified for modification. But, I did not get notification.

Here is my code:-

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/inotify.h>
#include <unistd.h>

#define EVENT_SIZE  ( sizeof (struct inotify_event) )
#define BUF_LEN     ( 1024 * ( EVENT_SIZE + 16 ) )

const char * file_path = "/dev/sda1";

int main( int argc, char **argv ) 
{
  int length, i;
  int fd;
  int wd;
  char buffer[BUF_LEN];


  while(1)
  {

    fd = inotify_init();

     if ( fd < 0 ) {
       perror( "inotify_init" );
     }

     wd = inotify_add_watch(fd, file_path, IN_MODIFY);

     if (wd < 0)
            perror ("inotify_add_watch");


      length = read( fd, buffer, BUF_LEN );

      printf("here too\n");

      if ( length < 0 ) {
          perror( "read" );
      }

          i = 0;

      while ( i < length ) {
          struct inotify_event *event = ( struct inotify_event * ) &buffer[ i ];
          printf("inotify event\n");


         if ( IN_MODIFY ) {
             if ( event->mask & IN_ISDIR ) {
                  printf( "The directory %s was modified.\n", file_path );
            }
              else {
                  printf( "The file %s was modified.\n", file_path );
              }
          }

          i += EVENT_SIZE + event->len;

      }

      ( void ) inotify_rm_watch( fd, wd );
      ( void ) close( fd );
  }



  exit( 0 );
}

This code notifies for a normal file correctly whenever the file gets modified. But, it doesn't work on device file, whenever there are changes in corresponding device mount directory. Is there anything wrong with my approach? Shouldn't /dev/sdX file get modified dynamically, whenever file system mounted on it gets changed?

I found a similar question Get notified about the change in raw data in hard disk sector - File change notification , but there were no useful answers on it.

Yogiraj
  • 308
  • 5
  • 14

1 Answers1

3

/dev/sda1 is a block device, not a regular file. inotify cannot observe devices for modifications. (Consider what this would even mean for other types of devices, like /dev/random…)

If you want to watch for any change on a filesystem, use fanotify instead.

  • Will fanotify be able to observe device file for modifications then? Can I expect it to notify for modification whenever I add/delete/edit a file/directory in the directory where it is mounted? – Yogiraj Jun 28 '17 at 05:01
  • Not a device file, but it can observe an entire filesystem for changes at once. (Which is better, because not all filesystems are backed by devices.) Read the documentation I linked. –  Jun 28 '17 at 05:30
  • I am currently working on RAID. So, I need notification for modification in a particular external hard disk/hard disk partition. That hard disk partition might not be mounted as a file system. So, observing a mounted file system is not useful for me. – Yogiraj Jun 28 '17 at 07:44
  • @YogirajKulkarni Then you're out of luck. There is no userspace interface for observing changes to a block device; the RAID implementations already present in Linux (there are several!) are all in the kernel. –  Jun 28 '17 at 17:52
  • Don't think all RAID implementations are in the kernel. I know of MDADM, which is a Linux utility written in C. I just downloaded its source code from github repo, compiled it (using Makefile) and I am able to run it. So, it seems that it is possible at application level too. – Yogiraj Jun 29 '17 at 04:29
  • @YogirajKulkarni mdadm is a utility for managing the md RAID implementation, [which is in the kernel](https://github.com/torvalds/linux/tree/master/drivers/md). –  Jun 29 '17 at 04:35
  • I downloaded mdadm from (https://github.com/neilbrown/mdadm) which seems to be an application. Does this use the md driver, whose link you posted? Also, I am not intending to build a new RAID implementation, I just want to build an application for light-weight RAID monitoring. – Yogiraj Jun 29 '17 at 05:15
  • @YogirajKulkarni If you just want to monitor the health of the array, mdadm and/or `/proc/mdstat` probably already has what you want. –  Jun 29 '17 at 05:59
  • Yes. But, my project is to use a different cryptographic idea to monitor RAID more efficiently. It will be similar to mdadm, but will be based on different concept. Since mdadm does that, I feel that it may be possible to detect disk modification for an application. – Yogiraj Jun 29 '17 at 07:27
  • @YogirajKulkarni Sector replication is handled by the kernel. mdadm isn't involved -- it's only used to initialize/modify/start/stop the array, and to receive notifications from the kernel about status changes. You really need to become more familiar with how md RAID works before trying to implement changes to it. –  Jun 29 '17 at 07:40