inotifywait support for xattrs

[ross-spencer]

Thinking about how to continually monitor changes to xattrs I wanted to test inotifywait from inotify-tools: https://github.com/inotify-tools/inotify-tools (101: https://oneuptime.com/blog/post/2026-01-15-use-inotifywait-file-monitoring-ubuntu/view)

A small demo:

Create two terminal tabs or windows.

Window 1:

mkdir /tmp/xattrs/

Window 2:

inotifywait -mr --format "%T %:e %w%f%0" --timefmt "%Y-%m-%dT%H:%M:%S" /tmp/xattrs

This runs inotify in monitoring mode, and recursively so that it can monitor files and directories underneath the folder we just created. We format the event log so there is a timestamp and it follows a predictable pattern we might consume in another tool.

NB. It's not clear if I can make the timestamp UTC.

Window 1:

cd /tmp/xattrs/
touch testfile1
xattr -w user.demo value1 testfile1
xattr -w user.demo2 value2 testfile1
mkdir subdir
cd subdir
touch testfile2
xattr -w user.demo1 value testfile2
cd ..
xattr -d user.demo2 testfile1

Window 2 (output):

Setting up watches.  Beware: since -r was given, this may take a while!
Watches established.
2026-04-24T09:52:07 CREATE /tmp/xattrs/testfile1
2026-04-24T09:52:07 OPEN /tmp/xattrs/testfile1
2026-04-24T09:52:07 ATTRIB /tmp/xattrs/testfile1
2026-04-24T09:52:07 CLOSE_WRITE:CLOSE /tmp/xattrs/testfile1
2026-04-24T09:52:23 ATTRIB /tmp/xattrs/testfile1
2026-04-24T09:52:37 ATTRIB /tmp/xattrs/testfile1
2026-04-24T09:52:46 CREATE:ISDIR /tmp/xattrs/subdir
2026-04-24T09:52:46 OPEN:ISDIR /tmp/xattrs/subdir
2026-04-24T09:52:46 ACCESS:ISDIR /tmp/xattrs/subdir
2026-04-24T09:52:46 CLOSE_NOWRITE:CLOSE:ISDIR /tmp/xattrs/subdir
2026-04-24T09:52:51 CREATE /tmp/xattrs/subdir/testfile2
2026-04-24T09:52:51 OPEN /tmp/xattrs/subdir/testfile2
2026-04-24T09:52:51 ATTRIB /tmp/xattrs/subdir/testfile2
2026-04-24T09:52:51 CLOSE_WRITE:CLOSE /tmp/xattrs/subdir/testfile2
2026-04-24T09:53:04 ATTRIB /tmp/xattrs/subdir/testfile2
2026-04-24T09:53:23 ATTRIB /tmp/xattrs/testfile1

Result

Inotifywait has monitored the creation of new files and successfully monitored the addition/modification and deletion of extended attributes.

We can follow a log like this (or create similar tooling) to monitor a directory or set of directories setup to store large numbers of extended attribute based files for systems such as the AHAlodeck fs database.

Inotifywait can run as a daemon and the event logs sent elsewhere to be monitored or used to then trigger other events around the attributes such as indexing.

[pjotrek-b]

This sounds amazing!

I was hoping for inotify to be of use for this, but I haven't found the time to really test it.
Thank you so much.

Which filesystem did you test it on?
(I've recently focused all our development and testing work on ZFS, as this seems to be the best candidate for production use so far)

[ross-spencer]

Thanks Peter, I appreciate it!

Also, good question -- this is Ext4 -- I need to remember to include this info when talking about xattrs. Will circle back around to look at ZFS soon too.