Detect when a file has been recreated using a stat watcher

Marc Lehmann schmorp at
Mon Dec 22 21:51:19 CET 2008

On Mon, Dec 22, 2008 at 08:11:57PM +0200, Graham Leggett <minfrin at> wrote:
> I tried this out on MacOSX 10.5, and found that monitoring ctime for  
> file rotation changes were giving me lots of false positives (the file  
> wasn't rotated at all, but every few seconds I was detecting "changes").

Yes, likely.

>      st_ctime         Time when file status was last changed (inode data 
> The fact that ctime is updated on write() means that in theory, it  
> cannot be used to detect file rotation.

Just fyi: write *may* update the ctime, but doesn't do so in every
case. It will likely do so in your case, however, as the size changes.

I don't understand why it can't be used to detetc logfile rottaion,
though?  The ctime changes, too, with logfile rotation.

> There is also a stat64 structure, with higher precision on the file  
> times, as follows:

Please note that the *structure* has more space for this, but most
filesystems do not actually support fractional times.

So using stat64 doesn't magically give you higher accuracy.

> This second stat64 definition would imply that "last status change" and  
> "file creation" (what I am looking for) are two separate things.

Absolutely. But the ctime likely changes on file creation, or the size, or
something else (such as the inode number).

This all depend son how your logfiles get rotated - the file might get
trucnated, deleted or somethign else might happen.

> My question is, is libev using the stat64 structure by way of comparison?

No. And it wouldn't help your case unless you require the logifle to be on
a specific filesystem supporting higher resolution timestamps. And even
then, the higher resolution might sitll just be centiseconds or so.

All this doesn't help you. The documentation (that you somehow fail to
know, for inexplicable reasons) explains this case in mroe details and
offers ways to implement this properly in your app.

> Is there a way for me to detect whether the stat or the stat64 structure  
> is in use at a given time?

No, that usually depends on how libev was compiled.

Note that stat64 on most unices doesn't have a higher resolution, as stat
already provides that, and stat64 is only for LFS.

some systems (freebsd for example) sanely default their compilation
environment to lfs, others (debian) inexplicably default to 32 bit and
try to patch eahc and every app to separately enable lfs, which would
presumably give you struct stat64.

> Is there a cross platform method to determine file rotation, by looking  
> at the attr and prev variables returned by a stat event?

Yes, but for some reason you claim it wouldn't work.

                The choice of a       Deliantra, the free code+content MORPG
      -----==-     _GNU_    
      ----==-- _       generation
      ---==---(_)__  __ ____  __      Marc Lehmann
      --==---/ / _ \/ // /\ \/ /      pcg at
      -=====/_/_//_/\_,_/ /_/\_\

More information about the libev mailing list