History of users modifying a file in Linux

Question

I am wondering if its possible to list who all modified the file with course of time. I am aware that stat or ls -lrt will give the last user who modified the file. But I want to find out if it is possible to find the N-1 user who modified the file.

Note: I think chances are very slim to find such user. Just want to confirm with experts before declaring its a dead end.

Example:

At 1:00 AM ABC modified the file
At 2:00 AM XYZ modified the same file.

I am aware that XYZ has modified the file, How to find who modified the file before XYZ (In this case ABC)?

`stat` or `ls` don't list who modified the file, they list who owns the file. Without a version control system you won't get the information you want. — Christoffer Hammarström, Sep 02 '15 at 09:15
I don't think it's possible. This is what `SCM` systems such as `Git` are for. — Arkadiusz Drabczyk, Sep 02 '15 at 09:15
Thanks I wanted to check , got my answer. Thanks for clarifying..... — , Sep 02 '15 at 09:18

score 9 · Answer 1 · answered Nov 25 '19 at 17:17

One hack that can be used is (This will only work for the recent modification) you can check the last modified time for the file, and cross check with the log-in times of the users. You might be able to narrow the list down.

use stat command (ex: stat , See this)
Find the Modify time
Use last command to see the log in history (see this)
Compare the log-in/log-out times with the file's Modify timestamp

This will not work all the time, but you can narrow the results down.

Jens · Accepted Answer · 2020-04-09T07:20:36.093

7

I am aware that stat or ls -lrt will give the last user who modified the file.

No. Modifying a file does not change its owner.

In general filesystems do not keep track of modification histories. If this information is crucial, the way to go is

For complete file hierarchies: a VCS (Version Control System) like Git, Subversion, Mercurial, CVS, ...
For single files, RCS or SCCS, ...

edited Apr 09 '20 at 07:20

answered Sep 02 '15 at 09:17

Jens

69,818
15
125
179

score 7 · Answer 3 · edited Jul 25 '20 at 16:52

It is possible to configure auditing to track changes to specific files. There are some limitations:

it has to be configured before the changes of interest
the auditing daemon tends to refuse to start if told to watch a file which has been deleted.

Still, it can be useful. Look for auditctl. Here are some useful links discussing the topic:

score 0 · Answer 4 · answered Aug 06 '19 at 09:54

0

It is not possible to track user details like username who modify the file by a particular command. Only we can check the assigned username to file by ls -l.

answered Aug 06 '19 at 09:54

SURJIT KUMAR

104
1
6

History of users modifying a file in Linux

Example:

4 Answers4