I am working on a daemon that monitors file events via inotify to trigger various types of events when files are accessed. I have read that watches are a little expensive, because the Kernel is storing the full path name of every file being watched.
How many watches would be too many?
Edit: Mostly, I'm wondering .. have you ever seen a noticeable performance hit, if so, at how many watches did it happen? Yes, I have to monitor / recursively (however its a minimal bootstrapped system).
You can find the system limits by reading /proc/sys/fs/inotify/max_user_instances (maximum number of inotify "objects") and /proc/sys/fs/inotify/max_user_watches (maximum number of files watched), so if you exceed those numbers, it's too many ;-) The maximum number of watches is usually several tens of thousands or higher - on my system, 262143 - which is probably more than you'd ever need unless you're trying to watch every file in a file system, but you shouldn't be doing that. I would say, just try not to use more inotify watches than you need to, and don't worry about it unless you notice a significant decrease in performance.
/proc/sys/fs/inotify/max_user_watches is the current max number of watches per user.
Historically, the kernel has defaulted this to 8192, but given that many Linux distros customize their kernel builds quite a bit, this may not be true on every Linux system. A recent kernel change [1] dynamically selects a default max_user_watches value in the range [8192, 1048576] based on how much RAM the system has. (5.11 is the first kernel release containing this change.)
AFAICT, root can change max_user_watches to any value that's 2147483647 (231-1) or under, as long as you're confident you have enough RAM to support that number of watches.
[1] https://github.com/torvalds/linux/commit/92890123749bafc317bbfacbe0a62ce08d78efb7
100 billions trillions gazillions would be too many, probably. Kernel Korner - Intro to inotify mentions “thousands of watches” so at least that number should not be a problem.
