I am working on a daemon that monitors file events via inotify to trigger various types of events when files are accessed. I have read that watches are a little expensive, because the Kernel is storing the full path name of every file being watched.
How many watches would be too many?
Edit: Mostly, I'm wondering .. have you ever seen a noticeable performance hit, if so, at how many watches did it happen? Yes, I have to monitor / recursively (however its a minimal bootstrapped system).
/proc/sys/fs/inotify/max_user_watches is the current max number of watches per user.
Historically, the kernel has defaulted this to 8192, but given that many Linux distros customize their kernel builds quite a bit, this may not be true on every Linux system. A recent kernel change [1] dynamically selects a default max_user_watches value in the range [8192, 1048576] based on how much RAM the system has. (5.11 is the first kernel release containing this change.)
AFAICT, root can change max_user_watches to any value that's 2147483647 (231-1) or under, as long as you're confident you have enough RAM to support that number of watches.
[1] https://github.com/torvalds/linux/commit/92890123749bafc317bbfacbe0a62ce08d78efb7