How can I monitor a directory for copy & pasting files?
The answer below need inotify-tools
, which might not be on your system. Run
sudo apt install inotify-tools
How to set up a watch script to keep log of what happens in a directory
As mentioned in comments, you can not "intercept" copy or move commands, unless you run them in terminal and use the script
command to record what is happening.
You can however keep an eye on what happens inside a directory, with inotifywait
Basic inotifywait script to keep record of your directory
A simple script would be:
#!/bin/bash
DIR="/path/to/directory/to/watch"
inotifywait -m -r -e move -e create "$DIR" | while read f
do
# remove 'echo changed' after the test
echo changed
echo $f >> /path/to/logfile.txt
done
Simply set the paths to the directory in the script, save it as some_script.sh
and run it. More advanced would of course be to time stamp events, analyze output etc, but this is the main idea. Instead of "echoing" the output, you could use the -o
option, see man inotifywait.
Explanation
To log continuesly, you need to set the option -m
:
from man inotifywait
:
-m, --monitor
Instead of exiting after receiving a single event, execute indefinitely. The default behaviour is to exit after the first event occurs.
To log recursively, you need to set the option -r
:
-r, --recursive
Watch all subdirectories of any directories passed as arguments. Watches will be set up recursively to an unlimited depth. Symbolic links are not traversed. Newly created subdirectories will also be watched.
Furthermore, you need to specify event(s) to trigger:
EVENTS
The following events are valid for use with the -e option:
access A watched file or a file within a watched directory was read
from.
modify A watched file or a file within a watched directory was written
to.
attrib The metadata of a watched file or a file within a watched direc‐
tory was modified. This includes timestamps, file permissions,
extended attributes etc.
close_write
A watched file or a file within a watched directory was closed,
after being opened in writeable mode. This does not necessarily
imply the file was written to.
close_nowrite
A watched file or a file within a watched directory was closed,
after being opened in read-only mode.
close A watched file or a file within a watched directory was closed,
regardless of how it was opened. Note that this is actually
implemented simply by listening for both close_write and
close_nowrite, hence all close events received will be output as
one of these, not CLOSE.
open A watched file or a file within a watched directory was opened.
moved_to
A file or directory was moved into a watched directory. This
event occurs even if the file is simply moved from and to the
same directory.
moved_from
A file or directory was moved from a watched directory. This
event occurs even if the file is simply moved from and to the
same directory.
move A file or directory was moved from or to a watched directory.
Note that this is actually implemented simply by listening for
both moved_to and moved_from, hence all close events received
will be output as one or both of these, not MOVE.
move_self
A watched file or directory was moved. After this event, the
file or directory is no longer being watched.
create A file or directory was created within a watched directory.
delete A file or directory within a watched directory was deleted.
delete_self
A watched file or directory was deleted. After this event the
file or directory is no longer being watched. Note that this
event can occur even if it is not explicitly being listened for.
unmount
The filesystem on which a watched file or directory resides was
unmounted. After this event the file or directory is no longer
being watched. Note that this event can occur even if it is not
explicitly being listened to.
You need to prepend each of your events, to be triggered, with -e
:
-e move -e create
Of course you can set any event trigger from the list.
The result
A short test of my watch script gives us an output like:
/home/jacob/Bureaublad/test/Untitled Folder/ MOVED_FROM CV.pdf
/home/jacob/Bureaublad/test/Untitled Folder/ MOVED_TO CV.pdf
/home/jacob/Bureaublad/test/Untitled Folder/ MOVED_TO pscript_3.py
/home/jacob/Bureaublad/test/Untitled Folder/ MOVED_TO,ISDIR numpy
/home/jacob/Bureaublad/test/Untitled Folder/ CREATE Untitled Document 3
/home/jacob/Bureaublad/test/Untitled Folder/ CREATE,ISDIR Untitled Folder