Arieh's Weblog

I am in the process of investigating the ability to monitor large numbers of files in a system.

A lot of material has been written about this topic here (Kegel), here (Erenkranz), as well as BSD's Kqueue.

Most of the discussion on those centers on monitoring sockets, pipes, streams, etc.

In that context, there is an open source project File Alteration Monitor that tries to deal with the topic of monitoring files and directories.

I begun my investigation with using the /dev/poll device.

In general, the idea is to open the files being monitored and register their file descriptors with the /dev/poll device. What I wanted is that if any of those files are written to, that the DP_POLL will 'fire' and I will get the event that the file has indeed been written to.

I have not been able to observe the expected behavior. Instead, it seems as 'regular' files operate with poll(7d) in a manner similar to what poll(2) state, namely, that regular files trigger for read, write and error always, therefore not allowing to trigger on writes to the file, for example.

Having read Bart Smaalders blog article on event ports I decided to try using that new feature of Solaris 10.

In my program, I proceeded to open the files I wanted to monitor, get the file descriptors and associate them with the port that I created. I was unable to associate the 'regular' file with the port, with the library call returning a EBADFD for the file descriptor.

I am wondering if I am doing something wrong (probably) or that what I want to do is not possible with the /dev/poll device or the event ports subsystem.

Later at night, from home, I tried to use the kqueue functionality available on BSD systems. I was successful in doing so, getting events on file appends, truncates, etc.

I liked the flexibility that kqueue provides and wonder whether there is similar richness of functionality on event ports or /dev/poll.