NAME

       incrontab - tables for driving inotify cron (incron)

DESCRIPTION

       An  incrontab  file contains instructions to the incrond(8) daemon of the general form: "run this command
       on these file events". There are two categories of tables: system tables (with root privileges) and  user
       tables (with user privileges).

       System  tables are (by default) located in /etc/incron.d and may have any names. Each system table exists
       separately inside incron and their watches never collide.

       Each user has their own table, and commands in any given incrontab will be executed as the user who  owns
       the incrontab. System users (such as apache, postfix, nobody etc.) may have their own incrontab.

       incrontab files are read when the incrond(8) daemon starts and after any change (incrontab file are being
       hooked when incrond is running).

       Blank lines are ignored. The general line format is the following:

       <path> <mask> <command>

       Where path is an absolute filesystem path, mask is an event  mask  (in  symbolic  or  numeric  form)  and
       command  is  an  executable  file (or a script) with its arguments. See below for event mask symbols. The
       executable file may be noted as an absolute  path  or  only  as  the  name  itself  (PATH  locations  are
       examined).

       Please  remember  that  the  same path may occur only once per table (otherwise only the first occurrence
       takes effect and an error message is emitted to the system log).  Please  not  that  the  *  wildcard  is
       allowed to observe a range of files.

EVENT SYMBOLS

       These basic event mask symbols are defined:

       IN_ACCESS           File was accessed (read) (*)
       IN_ATTRIB           Metadata changed (permissions, timestamps, extended attributes, etc.) (*)
       IN_CLOSE_WRITE      File opened for writing was closed (*)
       IN_CLOSE_NOWRITE    File not opened for writing was closed (*)
       IN_CREATE           File/directory created in watched directory (*)
       IN_DELETE           File/directory deleted from watched directory (*)
       IN_DELETE_SELF           Watched file/directory was itself deleted
       IN_MODIFY           File was modified (*)
       IN_MOVE_SELF        Watched file/directory was itself moved
       IN_MOVED_FROM       File moved out of watched directory (*)
       IN_MOVED_TO         File moved into watched directory (*)
       IN_OPEN             File was opened (*)

       When  monitoring  a  directory,  the  events marked with an asterisk (*) above can occur for files in the
       directory, in which case the name field in the returned event data identifies the name of the file within
       the directory.

       The  IN_ALL_EVENTS symbol is defined as a bit mask of all of the above events. Two additional convenience
       symbols are IN_MOVE, which is a combination of IN_MOVED_FROM and IN_MOVED_TO, and IN_CLOSE which combines
       IN_CLOSE_WRITE and IN_CLOSE_NOWRITE.

       The following further symbols can be specified in the mask:

       IN_DONT_FOLLOW      Don't dereference pathname if it is a symbolic link
       IN_ONESHOT          Monitor pathname for only one event
       IN_ONLYDIR          Only watch pathname if it is a directory

       Additionally, there is a symbol which doesn't appear in the inotify symbol set. It is loopable=true. This
       symbol disables monitoring events until the current one is completely handled (until  its  child  process
       exits).   Also,  there is the symbol recursive=false. This symbol limits the observation on the specified
       directory and does not include subdirectories.  Finally, there is  also  the  symbol  dotdirs=true.  This
       symbol will include the hidden directories (where the names starts with a dot) in the observation.

WILDCARDS

       The following wildards may be used inside command specification:

       $$   dollar sign
       $@   watched filesystem path (see above)
       $#   event-related file name
       $%   event flags (textually)
       $&   event flags (numerically)

EXAMPLE

       These are some example rules which can be used in an incrontab file:

       /tmp IN_ALL_EVENTS abcd $@/$# $%

       /usr/bin IN_ACCESS,loopable=true abcd $#

       /home IN_CREATE /usr/local/bin/abcd $#

       /home IN_CREATE,dotdirs=true /usr/local/bin/abcd $#

       /home IN_CREATE,recursive=false /usr/local/bin/abcd $#

       /var/log 12 abcd $@/$#

       The  first  line  monitors  all  events on the /tmp directory. When an event occurs it runs a application
       called 'abcd' with the full path of the file as the first arguments and the event  flags  as  the  second
       one.

       The  second line monitors accesses (readings) on the /usr/bin directory. The application 'abcd' is run as
       a handler and the appropriate event watch is disabled until the program finishes. The file name  (without
       the directory path) is passed in as an argument.

       The  third  example  is used for monitoring the /home directory for newly create files or directories (it
       practically means an event is sent when a new user is added).  This  event  is  processed  by  a  program
       specified by an absolute path.

       The fourth example is the third example, but it will include hidden directories in the observation.

       The fifth example is the third example, but it will exclude sub-directories from the observation.

       And  the  final  line shows how to use numeric event mask instead of textual one. The value 12 is exactly
       the same as IN_ATTRIB,IN_CLOSE_WRITE.

SEE ALSO

       incrond(8), incrontab(1), incron.conf(5)

AUTHOR

       Andreas    Altair     Redmer     <altair.ibn.la.ahad.sy@gmail.com>     (please     report     bugs     to
       https://github.com/ar-/incron/issues ).  Lukas Jelinek <lukas@aiken.cz> .

COPYING

       This  program  is free software. It can be used, redistributed and/or modified under the terms of the GNU
       General Public License, version 2.