How do you know if you are out of watches? tail will tell!

• Start tail with the -f (follow) option on any old file, e.g. tail -f /var/log/dmesg:
  
  
  
  
  • If all is well, it will show the last 10 lines and pause; abort with Ctrl-C
  
  
  • If you are out of watches, it will fail with this somewhat cryptic error:
    
    

    tail: cannot watch '/var/log/dmsg': No space left on device

  
  

For the curious: Why is tail a "telltail"?

• Actually, any well-written app should have the courtesy of telling you, since the inotify API/calls clearly tells them what the deal is.


• Try strace tail -f ... instead, and when it succeeds, it ends with:
  
  

  
  
  inotify_add_watch(4, "/var/log/dmesg", IN_MODIFY...) = 1
  
  



• but if it fails, i.e. you are out of watches, it'll say:
  
  

  
  
  inotify_add_watch(4, "/var/log/dmesg", IN_MODIFY..)
  
  = -1 ENOSPC (No space left on device)
  
  

Can you increase the watches? By how much? Any tradeoffs?

Short answer: Sure, no sweat. Go to straight to a half-million (524288) if you want...the additional memory used should be negligible on a modern system with 4GB+ of memory.

• Each used inotify watch takes up 540 bytes (32-bit system), or 1 kB (double - on 64-bit) [sources: 1, 2]


• This comes out of kernel memory, which is unswappable.



• So, assuming you set the max at 524288, and all were used (improbable), you'd be using approx. 256MB/512MB of 32-bit/64-bit kernel memory

  
  
  
  
  
  • Note that your application will also use additional memory to keep track of the inotify handles, file/directory paths, etc. -- how much depends on its design.
  
  



• What's the max value? I guess none, in theory, as long as you have enough RAM. In practice, 524288 has been officially recommended by apps, and people have been setting it to 2 million, with the accompanying memory usage, of course.