Long delay before fanotify event on /etc/ld.so.cache being opened by execve
06:27 25 May 2026

I try to listen to file events using fanotify Linux API.

Sometimes when an execve happens, I get FAN_OPEN_PERM event for file /etc/ld.so.cache long after (more than half a minute) getting such an event for file /lib/x86_64-linux-gnu/ld-*.so.

Why can this happen?

linux linux-kernel fanotify