Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to detect the username of the last person that changed a file in a Unix environment?

share|improve this question
If sudo was used to do it, a log entry should be in /var/log, /var/log/auth.log on my system. – Thor Jul 27 '12 at 16:38

In retrospect, no, other than making assumptions based on user login times and who has permission to change the file and the timestamp of the changed file.

In advance, you can install auditd and set it up to watch for changes to files.

share|improve this answer

Install some logging software like Auditd.

Also, maybe you can look at your history.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.