I'm looking for guidance on how to find out which user has modified a particular file. While inotify is great to get notification when a particular file is touched, how do I figure out which user has modified that file? I can think of using lsof but I'm afraid that it may not be as "realtime" as I want and/or it might be too much of a tax on resources. By realtime, I mean that if a user simply executes a touch command on a file, by the time I run lsof on file, it may not be picked up by lsof.
Join Stack Overflow to learn, share knowledge, and build your career.
|
|
||||
|
|
|
You can use audit deamon:
Choose a file to monitor
Add audit for write and attribute change (
The file is touched by some user:
Check audit logs:
You can see the
For details of usage see man pages or this sample guide. |
|||||
|
|
If you add -i option in the earlier command, you will get output in more human readable format. You will get the uid converted to the real username in the server. ausearch -k my-file-changed -i | tail -1 |
|||
|
|