I'm currently learning a little bit the incron. To learn I have a working incron on a VM, watching when a file is moved into a watched folder.
Here is the incron :
/var/share/entrant/DEFAULT/ IN_CLOSE,IN_CLOSE_WRITE,IN_CLOSE_NOWRITE /opt/maarch/separateur_qr/scripts/incron.sh $@$#
So it use the IN_CLOSE, IN_CLOSE_WRITE, IN_CLOSE_NOWRITE event. But after read the incron doc, I see the IN_MOVE_TO event.
Why it works with this 3 events ? For me it's brainfuck, because I don't think the file is opened when moved.
Whether the file is opened or not when moved depends on the target location:
When the target location is on the same filesystem as the original location, mv will just use the rename syscall an do not open the file.
When the target location is on a different filesystem, mv will open the file, copy it using read / write system calls and finally remove the original file.