I need to get detailed information of certain file or folder, such as chmod, changed date, which user.
How can I do this?
Asked
Active
Viewed 203 times
-2
-
1You might give ls -al or stat
a try – Univ426 Jan 09 '13 at 15:47 -
Either you have to audit it or stat it when you want. – Soham Chakraborty Jan 09 '13 at 15:51
-
I think stat reports more info about file for my needs. – Kad Jan 09 '13 at 15:59
-
I think some malicious script changed my php file chmod settings so i need to know details of that to increase security – Kad Jan 12 '13 at 00:25
2 Answers
2
You can try to use inotifywait
Try like this:
inotifywait -e attrib -m the_folder_to_watch
Where -e is the event to monitor, -m is monitor continuously.
See the blogpost here: http://en.positon.org/post/A-solution-to-the-umask-problem%3A-inotify-to-force-permissions
And the man for inotifywait: http://linux.die.net/man/1/inotifywait
user9517
- 115,471
- 20
- 215
- 297
Sharuzzaman Ahmat Raslan
- 420
- 1
- 5
- 15
0
There is no way to do this (that I know of, I could be corrected and learn something as well) unless you've installed a package to handle this. Meaning, if you didn't plan ahead and monitor a file, there is no way to get this information. All you'll be able to get from the file is the basic information that the stat <filename> cmd shows you, which wont show you what user altered a file.
That being said, in the future there are packages like audit that help you handle this and after you set a file to be audited, a simple ausearch -f <filename> would allow you to see this type of information.
You could also use something like aide -- which I personally like.
Ethabelle
- 2,052
- 14
- 20