Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible on Linux to find out which applications have accessed a certain file in the last 24 hours?

I've come with a few possible solutions:

  1. Watch lsof. It works, but it's constrained to watch's granularity.
  2. inotify sounds good... but no information of the application accessing the file is provided.
  3. auditd may be useful, but I haven't checked that yet.

What ways can I see which applications have accessed a certain file within a given time period?

share|improve this question
I assume that you're using a posix operating system since you mention lsof and other utilities. – Wesley Mar 21 '12 at 0:23
up vote 1 down vote accepted

auditd would be the way to go for this. Here's a quick tutorial on how to accomplish monitoring a file. You'll have to setup a watch on the file beforehand though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.