Let's say you're waiting for a client to upload a file to you, or perhaps you need to know the moment that accounting is done with a particular report. In both cases you can't rely on them to email you that they have saved the file in the appropriate location. There's an easy way to watch for this.

iWatch is a great little utility that tries to be a simple Tripwire for monitoring security, but is really best used in the above situations. It will monitor a file or directory, recursively or not, for various changes and email a particular recipient when the change occurs. It relies on Postfix for sending outbound notices.

The beauty of iWatch is it's ability to only monitor for certain events. For instance, I want to know when a file is added to a directory, but I don't care about subsequent modifications or deletions to that file. iWatch can monitor just the one event (or any combination of events including mounting of partitions.)

In daemon mode, it is configured with a simple XML file. The documentation appears sparse, but it's really very easy to figure out.

I would not recommend iWatch to act as any sort of intrusion detection system - it would be trivial to circumvent and really adds no real security. There are better tools available for that type of monitoring. For simple notifications of directory or file updates however, it's a great utility and can be up and running in minutes.

It's available in the Ubuntu repositories, so just do:

sudo apt-get install iwatch

Or use your favorite package manager to install.