1

Is it possible on Linux to find out which applications have accessed a certain file in the last 24 hours?

I've come with a few possible solutions:

  1. Watch lsof. It works, but it's constrained to watch's granularity.
  2. inotify sounds good... but no information of the application accessing the file is provided.
  3. auditd may be useful, but I haven't checked that yet.

What ways can I see which applications have accessed a certain file within a given time period?

phemmer
  • 5,909
  • 2
  • 27
  • 36
Nikolaidis Fotis
  • 2,032
  • 11
  • 13
  • I assume that you're using a posix operating system since you mention `lsof` and other utilities. – Wesley Mar 21 '12 at 00:23

1 Answers1

1

auditd would be the way to go for this. Here's a quick tutorial on how to accomplish monitoring a file. You'll have to setup a watch on the file beforehand though.

Kyle
  • 1,589
  • 9
  • 14