Karthick
10/06/2022, 4:04 AMMike Myers
10/06/2022, 7:15 PMKarthick
10/07/2022, 12:20 PMThomas Stromberg
10/07/2022, 2:02 PMfs.inotify.max_user_watches
, you may see unusual behavior. To see what your systems maximum number of inotify watches is:
sysctl fs.inotify.max_user_watches
On my system, this is 524,288, but on some systems it is as low as 8192 by default. You can adjust this using sysctl -w
.
To see how many inotify watches your system currently has registered (this may not be 100% accurate):
sudo find /proc/*/fd -lname anon_inode:inotify -printf '%hinfo/%f\n' | sudo xargs grep -hc "^inotify" | awk '{s+=$1} END {print s}'
To find out how many inotify handles at a minimum watching /etc, /opt, and /usr via inotify will require:
sudo find /etc /usr /opt | wc -l
On my system this count is 613,461, which exceeds my maximum inotify watches.auditd
or ebpf
, and use the process_file_events
table instead of file_events
- as it has all filesystem events, regardless of location. The table layout is different though.Mike Myers
10/07/2022, 7:50 PMKarthick
10/08/2022, 3:40 AM