Advanced File Management with lsof, inotify, and rsync

IntermediateLinux~3 hours
lsofinotifywaitrsyncdelta

I used lsof to trace open file handles, inotifywait to react to filesystem events, and rsync for delta-based synchronization. Together these tools diagnosed "file in use" problems and moved large trees efficiently by transferring only changed blocks.

Objective & Context

Beyond basic copies, real admin work means finding what holds a file open, reacting to changes, and syncing efficiently. This lab covers lsof for handle inspection, inotify for event-driven automation, and rsync's delta algorithm.

Environment & Prerequisites

  • Linux with lsof, inotify-tools, and rsync.
  • A source and destination tree to sync.
  • A process holding a file open to inspect.

Step-by-Step Execution

1. Find what holds a file open

lsof /var/log/app.log

2. React to filesystem events

inotifywait -m -e close_write ./incoming

3. Delta sync a tree

rsync -aHAX --delete --info=stats2 src/ dst/
Number of regular files transferred: 12
Total transferred file size: 4.20M (of 1.8G total)

Validation & Testing

Modify a few files and re-run rsync to confirm only deltas transfer; use lsof to confirm a locked file's owning PID. Pass criteria: rsync transfers only changed data and lsof correctly identifies the holding process.

Advanced: Troubleshooting
  • Cannot delete "busy" file: lsof reveals the PID; stop or restart it.
  • rsync re-copies everything: preserve timestamps with -a; clock skew defeats delta.
  • inotify misses events: raise fs.inotify.max_user_watches for large trees.

Key Results

  • Synced a 1.8GB tree transferring only 4.2MB of deltas.
  • Pinpointed file-locking processes instantly with lsof.
  • Automated reactions to file events via inotify.
  • Preserved ACLs and xattrs across sync with -aHAX.

Related Labs