Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does Linux record who last changed a file (rather than created it)? If so, how do I find this out? If not, is there some way of monitoring file(s)?

share|improve this question
up vote 14 down vote accepted

See who made changes to a file

Install the audit package using the package manager for your distribution and start the service.

Set a watch for a file you're interested in, such as /etc/passwd

# auditctl -w /etc/passwd -p war -k password-file

See the audit records for that file

# ausearch -f /etc/passwd | less
share|improve this answer

Generally, no. I've never tried it, but if you want to track users accessing particular file, you can take a look at audit

share|improve this answer

No, there's no record keeping of who modified which file.

To give you an idea, you might check the logs to see who was logged in at that time, and under ideal circumstances, history files can examined.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.