Exemple je veux ecrire un fichier contenant la date dans /tmp chaque fois qu'un nouveau fichier est créé dans mon répertoire:
Le cron aura cette forme:

pme@lendsk:~$ incrontab -l
/home/pme IN_CREATE /usr/bin/pmetest $&

ou pmetest est le script à exécuter.

Remarque importante: N'insérez AUCUN espace entre les arguments sous peine de voir un :

incrond:  cannot exec process: No such file or directory dans le /var/log/syslog.

Contenu du script pmetest:

pme@lendsk:~$ cat /usr/bin/pmetest
#!/bin/bash

echo "Evenements: $(date)" >> /tmp/suivi$1


Je crée un fichier dans mon répertoire et je vérifie:

pme@lendsk:~$ echo TEST > essai
time 48sec
pme@lendsk:~$ echo TEST > essai2


pme@lendsk:~$ ll /tmp/suivi*
-rw-r--r-- 1 pme pme 84 jui 14 19:03 /tmp/suivi256

pme@lendsk:~$ cat /tmp/suivi256
Evenements: Tue Jul 14 19:02:00 CEST 2009
Evenements: Tue Jul 14 19:03:48 CEST 2009

EXEMPLE 2:

pme@lendsk:~/Desktop/Téléchargements$ incrontab -l
/home/pme/Desktop/Téléchargements IN_CREATE /usr/bin/pmetest $@/$#

pme@lendsk:~/Desktop/Téléchargements$ cat /usr/bin/pmetest
#!/bin/bash

echo "Evenements: creation le $(date) de $1/$2" >> /tmp/suivi

Je crée un fichier dans /home/pme/Desktop/Téléchargements

pme@lendsk:~/Desktop/Téléchargements$ echo TEST > toto

Je vérifie:

pme@lendsk:~/Desktop/Téléchargements$ cat /tmp/suivi
Evenements: creation le Tue Jul 14 19:33:16 CEST 2009 de /home/pme/Desktop/Téléchargements/toto/




On imagine très bien les utilisations possibles: lancer un clamscan sur le répertoire des téléchargements par exemple dès qu'un fichier est écrit.

La liste des événements se trouvent dans le fichier /usr/include/linux/inotify.h dont voici un extrait:

/* the following are legal, implemented events that user-space can watch for */
#define IN_ACCESS               0x00000001      /* File was accessed */
#define IN_MODIFY               0x00000002      /* File was modified */
#define IN_ATTRIB               0x00000004      /* Metadata changed */
#define IN_CLOSE_WRITE          0x00000008      /* Writtable file was closed */
#define IN_CLOSE_NOWRITE        0x00000010      /* Unwrittable file closed */
#define IN_OPEN                 0x00000020      /* File was opened */
#define IN_MOVED_FROM           0x00000040      /* File was moved from X */
#define IN_MOVED_TO             0x00000080      /* File was moved to Y */
#define IN_CREATE               0x00000100      /* Subfile was created */
#define IN_DELETE               0x00000200      /* Subfile was deleted */
#define IN_DELETE_SELF          0x00000400      /* Self was deleted */
#define IN_MOVE_SELF            0x00000800      /* Self was moved */

/* the following are legal events.  they are sent as needed to any watch */
#define IN_UNMOUNT              0x00002000      /* Backing fs was unmounted */
#define IN_Q_OVERFLOW           0x00004000      /* Event queued overflowed */
#define IN_IGNORED              0x00008000      /* File was ignored */

/* helper events */
#define IN_CLOSE                (IN_CLOSE_WRITE | IN_CLOSE_NOWRITE) /* close */
#define IN_MOVE                 (IN_MOVED_FROM | IN_MOVED_TO) /* moves */

/* special flags */
#define IN_ONLYDIR              0x01000000      /* only watch the path if it is a directory */
#define IN_DONT_FOLLOW          0x02000000      /* don't follow a sym link */
#define IN_MASK_ADD             0x20000000      /* add to the mask of an already existing watch */
#define IN_ISDIR                0x40000000      /* event occurred against dir */
#define IN_ONESHOT              0x80000000      /* only send event once */

/*
 * All of the events - we build the list by hand so that we can add flags in
 * the future and not break backward compatibility.  Apps will get only the
 * events that they originally wanted.  Be sure to add new events here!
 */
#define IN_ALL_EVENTS   (IN_ACCESS | IN_MODIFY | IN_ATTRIB | IN_CLOSE_WRITE | \
                         IN_CLOSE_NOWRITE | IN_OPEN | IN_MOVED_FROM | \
                         IN_MOVED_TO | IN_DELETE | IN_CREATE | IN_DELETE_SELF | \
                         IN_MOVE_SELF)