Seeing which inotify watches are being created

inotify.c

/*
 * If you want to see which inotify watches are being created by an application then you can
 * use this simple piece of code, compile it to a shared library and LD_PRELOAD it when starting
 * the application. Keep an eye on syslog to see the list of watches.
 * **NOTE**: this only logs the watches, it won't actually create the watch and thus watching
 * for changes WON'T actually WORK!
 *
 * More details (adjust as needed for your environment/distribution):
 * - Save this file in e.g. $HOME/inotify.c
 * - Compile: gcc -shared -o inotify.so inotify.c
 * - Start monitoring syslog: tail -f -n 0 /var/log/syslog | tee $HOME/watches.log
 * - Run your application with: LD_PRELOAD=$HOME/inotify.so <application>
 */

#include <sys/inotify.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>

int inotify_add_watch(int fd, const char *pathname, uint32_t mask)
{
    syslog(LOG_USER | LOG_ERR, "********** [%u] inotify_add_watch for %s", getpid(), pathname);
    return 100000;
}