linux-kernel - Missing inotify events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date:	Wed, 21 Mar 2012 16:42:52 +0100
From:	Marc Giger <gigerstyle@....ch>
To:	linux-kernel@...r.kernel.org
Subject: Missing inotify events

Hello,

I have a Java application which writes multiple files in a short period of time. When I watch the
filechanges with inotifywait sometimes events are missing. To find out what's going on I straced
the java application to see if the files are e.g. properly closed:

26467 open("/tmp/refapps2/20051002/giger/documents/891877A1C3FB7CEA477B/1332340770691_Ping_unknown_TransmitterRequestRaw_UTF-8.xml", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 804
26467 close(804)                        = 0
26467 open("/tmp/refapps2/20051002/giger/documents/891877A1C3FB7CEA477B/1332340770728_PingResponse_unknown_TransmitterResponseRaw_UTF-8.xml", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 805
26467 close(805)

inotifywait reports:

/tmp/refapps2/20051002/giger/documents/ CREATE,ISDIR 891877A1C3FB7CEA477B
/tmp/refapps2/20051002/giger/documents/ OPEN,ISDIR 891877A1C3FB7CEA477B
/tmp/refapps2/20051002/giger/documents/ CLOSE_NOWRITE,CLOSE,ISDIR 891877A1C3FB7CEA477B
/tmp/refapps2/20051002/giger/documents/891877A1C3FB7CEA477B/ CREATE 1332340770728_PingResponse_unknown_TransmitterResponseRaw_UTF-8.xml
/tmp/refapps2/20051002/giger/documents/891877A1C3FB7CEA477B/ OPEN 1332340770728_PingResponse_unknown_TransmitterResponseRaw_UTF-8.xml
/tmp/refapps2/20051002/giger/documents/891877A1C3FB7CEA477B/ MODIFY 1332340770728_PingResponse_unknown_TransmitterResponseRaw_UTF-8.xml
/tmp/refapps2/20051002/giger/documents/891877A1C3FB7CEA477B/ CLOSE_WRITE,CLOSE 1332340770728_PingResponse_unknown_TransmitterResponseRaw_UTF-8.xml

This behavior can be repeated easily, but not that easy when running the app under strace (timing issue?).

I would expect that I get _all_ events as long as the event-queue is not full. No?

Ubuntu Kernel 2.6.32-37-server and also vanilla-kernel 3.2.6 running gentoo behave the same way.


Marc

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/