6

How do I get a list of:

  • Pathnames currently being watched by inotify, and
  • PID of the process watching

I ask because I have found that syncthing's inotify watches were preventing my disk from being unmounted.

As can be seen below, nothing appears in lsof or fuser listings.

I guessed well with syncthing... How do I remove the guesswork in future if a disk won't unmount due to inotify?

# umount /media/backup
umount: /media/backup: target is busy.
# lsof +f -- /media/backup/
# echo $?
1
# fuser -vmM /media/backup/
                     USER        PID ACCESS COMMAND
/media/backup:       root     kernel mount /media/backup
# systemctl stop syncthing@ravi
# umount /media/backup
# echo $?
0
Tom Hale
  • 28,728
  • 32
  • 139
  • 229
  • 2
    Relevant: [Who's consuming my inotify resources?](https://unix.stackexchange.com/q/15509/86440) – Stephen Kitt Aug 18 '17 at 08:08
  • 1
    From my reading of that, it's possible to know which processes have inotify watches, but not what they are watching. I hope to be wrong! – Tom Hale Aug 18 '17 at 08:11
  • 2
    That’s my impression too. Either way, once this question is answered it would be worth updating [How do I find out which processes are preventing unmounting of a device?](https://unix.stackexchange.com/q/3109/86440) – Stephen Kitt Aug 18 '17 at 08:23
  • @StephenKitt I've done that [here](https://unix.stackexchange.com/a/386960/143394), trying to collate all the relevant infomation into a single answer. Let me know if I've missed anything. – Tom Hale Aug 20 '17 at 12:13

2 Answers2

5

Maybe the fdinfo for the fd of the watch can be useful:

$ readlink /proc/$(pgrep inotify)/fd/3
anon_inode:inotify
$ cat /proc/$(pgrep inotify)/fdinfo/3
pos:    0
flags:  00
mnt_id: 11
inotify wd:1 ino:357a sdev:700000 mask:fff ignored_mask:0 fhandle-bytes:8 fhandle-type:1 f_handle:7a35000000000000

The sdev seems to be the major:minor device number combination, as seen in the output of lsblk, for example:

$ lsblk | grep 7
loop0    7:0    0  80.5M  1 loop /snap/core/2462

(I was indeed monitoring /snap/core/2462.)

For my /dev/sda1 which is 8:1, the output looked like so:

pos:    0
flags:  00
mnt_id: 11
inotify wd:1 ino:aae1b sdev:800001 mask:fff ignored_mask:0 fhandle-bytes:8 fhandle-type:1 f_handle:1bae0a0038e16969

This should be sufficient to find out what's blocking unmounting, even though the specific directories or files being watched aren't listed.

muru
  • 69,900
  • 13
  • 192
  • 292
  • Great lead. Using `mnt_id` as an index into `/proc/[pid]/mountinfo` would give the mountpoint directory. How to efficiently perform this check for all processes (irrespective of name)? – Tom Hale Aug 18 '17 at 08:50
  • 1
    [man proc(5)](http://man7.org/linux/man-pages/man5/proc.5.html) says `sdev: The ID of the device where the target file resides (in hexadecimal).` It also explains `mnt_id` and the `mountinfo` file. – Tom Hale Aug 18 '17 at 08:59
2

(WIP Answer)

Thanks to muru's answer for the kickstart.

Using the information in /proc/[pid]/fdinfo/[fd#]:

Possibly lsof: list only files of a particular type with a_inode.

Too slow as a shell script with all the greping. Perhaps system call interface to /proc information.

Tom Hale
  • 28,728
  • 32
  • 139
  • 229
  • I think I have exactly what you want, unless I am mistaken: https://unix.stackexchange.com/questions/15509/whos-consuming-my-inotify-resources/502812#502812 – oligofren Mar 16 '20 at 11:28