Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When a particular user logs in to a Linux machine, certain files are sourced, like perhaps .bashrc, .bash_profile, etc... Sometimes different shells mean different files are sourced. And of course the user might have something setup to source certain custom files of their own.

My question: Is there a way for root/su to determine a list of every file that is sourced for any given user when they login?

share|improve this question

2 Answers 2

inotifywatch may help. Packaged in inotify-tools. Use as the user of files/dir for home dir being watched, not sudo, or you'll get errors on .gvfs if running a newer gnome.

inotify will only tell you which files get accessed/created/modified/deleted.

$ inotifywatch -r /home/username/.* /home/username/*
Establishing watches...

in another terminal

$ cat /home/username/.bashrc 

in inotifywatch terminal ctrl-c to end

Finished establishing watches, now collecting statistics.
total  access  modify  close_nowrite  open  filename
3      1       0       1              1     /home/username/.bashrc

For your specific request, all files accessed during login.

$ inotifywatch -r /home/username/.* /home/username/*
Establishing watches...

in another terminal

$ sudo su
# login username

in inotifywatch terminal ctrl-c to end

You may want to redirect the inotifywatch to a file if using a fat desktop like gnome or kde. Or increase your scrollback in the inotifywatch terminal. In gnome 3, thousands of homedir files are accessed during login. You'll probably want to either exclude directories or make a specific dir/file list to watch.

share|improve this answer
    
What about /etc/* files? –  Jeff Ferland Jun 3 '11 at 18:54
    
inotifywatch -r /home/username/.* /home/username/* /etc/* –  joe Jun 4 '11 at 18:33
    
Well yes, expanding the commandline to monitor that directory will show files accessed from it. I was wondering if you might have something that would tie to a given process. It occurs to me, though, that filtering the results afterwards probably makes as much sense. –  Jeff Ferland Jun 4 '11 at 19:51

One way, rather inefficient way, is to boot the computer, have the person login. Then mount the drive with noatime so the access time doesn't get updated anymore, then use find to dump a list of files accessed in the time period the user logged in.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.