Home Directory Plugins Operating Systems Windows check_file_system_changes

Search Exchange

Search All Sites

Nagios Live Webinars

Let our experts show you how Nagios can help your organization.

Contact Us

Phone: 1-888-NAGIOS-1
Email: sales@nagios.com


Remember Me

Directory Tree


Current Version
Last Release Date
Compatible With
  • Nagios 1.x
  • Nagios 2.x
  • Nagios 3.x
  • Nagios XI
Network Monitoring Software - Download Nagios XI
Log Management Software - Nagios Log Server - Download
Netflow Analysis Software - Nagios Network Analyzer - Download
This is a plugin that accepts a given number of changes, a directory, and a list of events to watch for.

It returns the amount of time it has taken for the given number of changes (as defined events in FileSystemWatcher [changed, created, deleted, renamed]) to occur for the targeted directory (and sub-directories, in/exclusive).
.. It relies on the System.IO.FileSystemWatcher class which is part of the .NET Framework (since v1.0).

Three files can be excluded by argument:

1) Any file which contains 'DfsrPrivate' in it's path.
2) Any file which contains '_smbtestfile' in it's path (refer to the check_smb_speed plugin).
3) Any file which contains a given string in it's path.

It is written in C# and the source code will be available via github.

Attached is the .cs file of this plugin so far.


-NSCA server_IP:port:enc_algo:password [not required, colon separated list to pass to send_nsca, you must always set the port]
-N [number of changes]
-D [directory]
-S [not required, boolean, include it... include subdirectories]
-WL [watch list made up of FileSystemWatcher events changed, created, deleted and renamed (error is not included) in a colon separated list: as CH:CR:DE:RE)
-FL [filter list made up of FileSystemWatcher event notify filters File Name, Directory Name, Attributes, Size, Last Write, Last Access, Creation Time, Security; as FN:DN:AT:SZ:LW:LA:CT:SEC)
-EX [not required, exclude any file which contains 'DfsrPrivate', and '_smbtestfile'; as D:S respectively]
-EXSTR [not required, exclude any file which contains any of the case-insensitive strings contained in a colon separated list]
-INCSTR [not required, include only any file which contains any of the case-insensitive strings contained in a colon separated list**]
-BUFF [not required, change the buffer size utilized by the FileSystemWatcher to do it's thing, defaults to 8KB, acceptable 4-64KB (from the non-paged pool so it is sort of "dangerous" as the non-paged pool is finite); see http://goo.gl/TBFnP]

Total time it takes for N number of operations to occur.

Both of these command line examples pass the following NSCA configuration causing send_nsca to:
...send results to an NSCA server instance bound to The resultant data will be encrypted using Simple XOR (as documented in the send_nsca.exe win32 port of the send_nsca binary) with the password 'p@ssw0rd'.

check_file_system_changes -NSCA -N 100 -D 'D:shares' -S -WL CH:CR:DE:RE -EX D:S -EXSTR 'Home':'company_photos'

Watches for 100 change, create, delete and rename events in d:shares and all it's subdirectories, excluding any file that has 'DfsrPrivate' (case sensitive), '_smbtestfile' (case sensitive), 'home' or 'company_photos' (case-insensitive) in it's path name.

check_file_system_changes -NSCA -N 1 -D 'D:shares' -S -WL DE -EX D:S -INCSTR 'contacts'
Watches for 1 delete event in d:shares and all it's subdirectories, only including files with the string 'contacts' (case-insensitive) in it's path name.

** if the INCSTR argument contains only one string, then this will be used most efficiently, by utilizing the .Filter property of the FileSystemWatcher. Unfortunately, the .Filter property isn't very advanced; it doesn't take in conditional OR/multiple strings and it doesn't allow logical negation/"NOT these strings". The only way to do this is to allow the FileSystemWatcher to raise an event, then use a conditional statement to qualify if the FileSystemEventArgs.FileName contains the given string. An operation uses up our magical buffer space, obviously. If I was MSFT, I'd change this.