How would I get the PID of the process causing a file system event?

Question

I am considering to work with python-watchdog. Is there a way to determine which process (PID) caused a detected event?

---

Background: I am looking for a way to detect modify events caused by certain editors like vim, pycharm or kate. In a nutshell, those editors do not "modify" the original file when changes are saved. Instead, they create a new one and swap it with the old one - in slightly different various ways. See related issue in python-watchdog. Instead of re-configuring those editors, I am looking for ways of detecting those sequences of [create/delete/move] events and reliably re-interpreting as "pseudo modify" events of the original file.

Answer 1

The above demo is available here.

Any solution based on inotify, such as python-watchdog, will not be able to provide the process ID (PID). It is essentially a specification limitation of inotify itself. The only place to actually catch the PID is in the VFS-layer of the operating system. This means that one has to have access to the actual file system implementation - or implement a file system from scratch.

I implemented LoggedFS-python, a FUSE file system, for exactly this purpose. It's passing through any operation to an underlying "actual" file system and has access to the PID causing an operation, among other additional information.

loggedfs.loggedfs_notify provides the relevant infrastructure.