The application uses inotify_init() to create an inotify instance. This system call returns a file descriptor that is used to refer to the inotify instance in later operations.

The application informs the kernel about which files are of interest by using inotify_add_watch() to add items to the watch list of the inotify instance created in the previous step. Each watch item consists of a pathname and an associated bit mask. The bit mask specifies the set of events to be monitored for the pathname. As its function result, inotify_add_watch() returns a watch descriptor, which is used to refer to the watch in later operations. (The inotify_rm_watch() system call performs the converse task, removing a watch that was previously added to an inotify instance.)

In order to obtain event notifications, the application performs read() operations on the inotify file descriptor. Each successful read() returns one or more inotify_event structures, each containing information about an event that occurred on one of the pathnames being watched via this inotify instance.

When the application has finished monitoring, it closes the inotify file descriptor. This automatically removes all watch items associated with the inotify instance.