inotify监视文件状态改变

[root@Centos-1 tmp]# rpm -qa|grep inotify
inotify-tools-3.13-1.el5.rf

 

exam : 监视sshd的登录情况

 

#!/bin/bash
while inotifywait -qq -e modify /var/log/secure
do
        MSG=`tail -n1 /var/log/secure | grep sshd`
        if [ -n "$MSG" ] ; then
                echo "Somebody ssh to me!"
                echo $MSG
        fi
done