Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to detect the username of the last person that changed a file in a Unix environment?

share|improve this question
    
If sudo was used to do it, a log entry should be in /var/log, /var/log/auth.log on my system. –  Thor Jul 27 '12 at 16:38

2 Answers 2

Install some logging software like Auditd.

Also, maybe you can look at your history.

share|improve this answer

In retrospect, no, other than making assumptions based on user login times and who has permission to change the file and the timestamp of the changed file.

In advance, you can install auditd and set it up to watch for changes to files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.