Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to get detailed information of certain file or folder, such as chmod, changed date, which user.

How can I do this?

share|improve this question
1  
You might give ls -al or stat <filename> a try –  Univ1138 Jan 9 '13 at 15:47
    
Either you have to audit it or stat it when you want. –  Soham Chakraborty Jan 9 '13 at 15:51
    
I think stat reports more info about file for my needs. –  WishtobeNothing Jan 9 '13 at 15:59
    
I think some malicious script changed my php file chmod settings so i need to know details of that to increase security –  WishtobeNothing Jan 12 '13 at 0:25

2 Answers 2

You can try to use inotifywait

Try like this:

inotifywait -e attrib -m the_folder_to_watch

Where -e is the event to monitor, -m is monitor continuously.

See the blogpost here: http://en.positon.org/post/A-solution-to-the-umask-problem%3A-inotify-to-force-permissions

And the man for inotifywait: http://linux.die.net/man/1/inotifywait

share|improve this answer

There is no way to do this (that I know of, I could be corrected and learn something as well) unless you've installed a package to handle this. Meaning, if you didn't plan ahead and monitor a file, there is no way to get this information. All you'll be able to get from the file is the basic information that the stat <filename> cmd shows you, which wont show you what user altered a file.

That being said, in the future there are packages like audit that help you handle this and after you set a file to be audited, a simple ausearch -f <filename> would allow you to see this type of information. You could also use something like aide -- which I personally like.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.