Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to find a reliable way of finding which process on my machine is changing a configuration file (/etc/hosts to be specific).

I know I can use lsof /etc/hosts to find out what processes currently have the file open, but this doesn't help because the process is obviously opening the file, writing to it, and then closing it again.

I also looked at lsof's repeat option (-r), but it seems to only go as fast as once a second, which probably won't ever capture the write in progress.

I know of a couple tools for monitoring changes to the filesystem, but in this case I want to know which process is responsible, which means catching it in the act.

share|improve this question
up vote 43 down vote accepted

You can use auditing to find this. If not already available, install and enable auditing for your distro.

set an audit watch on /etc/hosts

/sbin/auditctl -w /etc/hosts -p war -k hosts-file

-w watch /etc/hosts
-p warx watch for write, attribute change, execute or read events
-k hosts-file is a search key.

Wait till the hosts file changes and then use ausearch to seer what is logged

/sbin/ausearch -f /etc/hosts | more

You'll get masses of output e.g.

time->Wed Oct 12 09:34:07 2011 type=PATH msg=audit(1318408447.180:870): item=0 name="/etc/hosts" inode=2211062 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 type=CWD msg=audit(1318408447.180:870): cwd="/home/iain" type=SYSCALL msg=audit(1318408447.180:870): arch=c000003e syscall=2 success=yes exit=0 a0=7fff73641c4f a1=941 a2=1b6 a3=3e7075310c items=1 ppid=7259 pid=7294 au id=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=123 comm="touch" exe="/bin/touch" subj=user_u:system_r:unconfined_t:s0 key="hosts-file"

In this case I used the touch command to change the files timstamp it's pid was 7294 and it's ppid was 7259 (my shell).

share|improve this answer
The "enable auditing for your distro" should probably be expanded a bit. Annoyingly, the commands above gave me neither errors nor results. "/sbin/auditctl -e 1" also didn't help. Running an audit deamon to do the logging did help - "/etc/init.d/auditd start" (though it deleted my rules, so I had to enter them again). – tobixen Jul 23 '12 at 10:19
Didn't work for me, ausearch always returns <no matches> – m0skit0 Nov 12 '15 at 10:59

You can also use inotify-tools:

  inotifywait -mq -e open -e modify /etc/hosts
share|improve this answer
Auditd is able to give you the information you want. Even though it's easy to make the assumption that inotify will let you do this - it won't, since it will not give you the process id that made the modification. – objectified Oct 12 '11 at 8:31

After a lot of search, I found the solution, just use this command: sudo fs_usage | grep [path_to_file]

share|improve this answer

probably better to use something like incron then

you can then get it to trigger a script to so some sort of diags

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.