64

I am working on a daemon that monitors file events via inotify to trigger various types of events when files are accessed. I have read that watches are a little expensive, because the Kernel is storing the full path name of every file being watched.

How many watches would be too many?

Edit: Mostly, I'm wondering .. have you ever seen a noticeable performance hit, if so, at how many watches did it happen? Yes, I have to monitor / recursively (however its a minimal bootstrapped system).

6 Answers 6

38

AFAIK the kernel isn't storing the pathname, but the inode. Nevertheless, there are 540 bytes per Watch on a 32bit system. Double as much on 64bit.

I know from Lsyncd (maybe you want to check that out?) people who have a million watches. It just eats a Gigabyte of memory.

25

/proc/sys/fs/inotify/max_user_watches is the current max number of watches per user.

Historically, the kernel has defaulted this to 8192, but given that many Linux distros customize their kernel builds quite a bit, this may not be true on every Linux system. A recent kernel change [1] dynamically selects a default max_user_watches value in the range [8192, 1048576] based on how much RAM the system has. (5.11 is the first kernel release containing this change.)

AFAICT, root can change max_user_watches to any value that's 2147483647 (231-1) or under, as long as you're confident you have enough RAM to support that number of watches.

[1] https://github.com/torvalds/linux/commit/92890123749bafc317bbfacbe0a62ce08d78efb7

1
  • Thanks for this. Accepting so it floats to the top as a 2021 answer (the question is getting a little up there in age).
    – user50049
    Apr 21, 2021 at 14:36
23

You can find the system limits by reading /proc/sys/fs/inotify/max_user_instances (maximum number of inotify "objects") and /proc/sys/fs/inotify/max_user_watches (maximum number of files watched), so if you exceed those numbers, it's too many ;-) The maximum number of watches is usually several tens of thousands or higher - on my system, 262143 - which is probably more than you'd ever need unless you're trying to watch every file in a file system, but you shouldn't be doing that. I would say, just try not to use more inotify watches than you need to, and don't worry about it unless you notice a significant decrease in performance.

6
  • 3
    why shouldnt i be using inotify to watch the entire filesystem? can you be specific?
    – Blub
    May 6, 2014 at 6:59
  • @Blub well why would you want to do it? Unless you're debugging a filesystem implementation, I can't think of a good use case, and if that's what you're doing, it's probably better to hook into the filesystem code itself. Not to mention, inotify probably won't have enough watches to actually watch everything on a filesystem with a modern OS. But I guess if it does (i.e. if you're working with a reduced set of files), it's probably not the worst thing. As long as your computer can handle it, it's not going to damage anything AFAIK.
    – David Z
    May 7, 2014 at 0:44
  • 4
    i want to index a volume and therefore if a file changes anywhere, i need to update my index. i did have a look at the ext4 source code, it's not exactly made for user addins.. there's just a dumpe2fs utility which can print "blocks", but no idea yet how to get actual filepaths out of there. And still.. I would need to run that utility constantly, at least once a second to reupdate the index. Not exactly great, I'd much prefer to get some event back - like inotify does.
    – Blub
    May 7, 2014 at 7:33
  • 4
    @Blub You man want to use fanotify for that, which requires only 1 "watch" for an entire file system (but requires root). fsnoop is an example.
    – nh2
    Mar 2, 2018 at 14:09
  • 11
    I am a little confused by this answer and the number of upvotes. Aren't max_user_instances and max_user_watches the current max values? Of course you can increase these, my max_user_watches was set to 8192 by default... Plus thanks for the "you shouldn't be doing what is bad" kind of non argument. I mean, the question was asked in the context of a project. Taking a look at what is set on your machine is totally irrelevant if its going to run others. Jul 28, 2018 at 8:04
11

It depends on how much ram you've got

While 524288 is the maximum number of files that can be watched, if you're in an environment that is particularly memory constrained, you may wish to lower the number. Each file watch takes up 540 bytes (32-bit) or ~1kB (64-bit), so assuming that all 524288 watches are consumed that results in an upper bound of around 256MB (32-bit) or 512MB (64-bit).

2
  • 14
    Do you know where the max number of watches allowed is documented / is the limit still at 524,288 today? Apr 7, 2020 at 1:20
  • 2
    why is 524188 the max number of files that can be watched? source?
    – Hicsy
    Jan 20, 2021 at 23:58
10

My info:

[foo@caffeine ~]# cat /var/log/lsyncd.status | grep Inotify
Inotify watching 293208 directories

[foo@caffeine ~]# cat /proc/sys/fs/inotify/max_user_watches
1048576

lsyncd uses about 130M of memory.

I use lsyncd to keep some directories in sync with the disaster recovery server.

No performance hit/penalty on the main server.

1
  • 11
    I think you are seeing lsyncd memory usage and not inotify... inotify uses kernel space memory...
    – confiq
    Sep 27, 2016 at 13:35
4

100 billions trillions gazillions would be too many, probably. Kernel Korner - Intro to inotify mentions “thousands of watches” so at least that number should not be a problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.