On 2023-02-17, Maksim Rodin <a23s4a2...@yandex.ru> wrote: >> > I was able to reproduce watching for new data and truncation of the >> > file using "kqueue" but I do not quite understand how the original tail >> > watches when the file appears again after deletion or renaming. > I am sorry that I could not be clear enough in my words above. > I meant I already understood a little how "kqueue" > magic works. And I replicated some event watching logic in my learning > task. > I see how file truncating, deleting and renaming is watched by waiting > NOTE_DELETE, NOTE_RENAME and NOTE_TRUNCATE events in EVFILT_VNODE > filter. > But I still do not see where and what event is watched for to make sure the > file with initial file name is back (e.g. after deletion). After deleting a > file there is no initial file > descriptor, so there is nothing to watch using the old EVFILT_VNODE > filter. > I also see that after NOTE_DELETE | NOTE_RENAME events are caught only > tfreopen function > is called and I do not see any event watching actions in that function.
It will probably be easier to grok if you see for yourself rather than have it explained. I suggest running tail under ktrace, and watch the output live e.g. with something like "kdump -l | ts %.T". In particular note the last parameter to kevent(). > So my primary question might be: how can I monitor file creation (using > events) > by only knowing its name? While events can be used as part of it, you do need a little more than events to watch for file creation.
