Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible on Linux to find out which applications have accessed a certain file in the last 24 hours?

I've come with a few possible solutions:

  1. Watch lsof. It works, but it's constrained to watch's granularity.
  2. inotify sounds good... but no information of the application accessing the file is provided.
  3. auditd may be useful, but I haven't checked that yet.

What ways can I see which applications have accessed a certain file within a given time period?

share|improve this question
    
I assume that you're using a posix operating system since you mention lsof and other utilities. –  Wesley Mar 21 '12 at 0:23
add comment

1 Answer

up vote 1 down vote accepted

auditd would be the way to go for this. Here's a quick tutorial on how to accomplish monitoring a file. You'll have to setup a watch on the file beforehand though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.