Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any file system - or monitoring tool - which logs which users have read and written which files?

Something like this:

2014-01-21 13:45:45  john  12939  /users/john/hello.txt   write
2014-01-21 13:45:55  paul  12939  /users/john/hello.txt   read

This should be restrictable to certain folders (only user files are interesting, not system files).

share|improve this question

You can try to install auditd. It is a useful tool to setup watches for specific files/folders operations. It support different operations: r=read, w=write, x=execute, a=attribute.

You can add a specific watch with a specific filter key for easy search.

Here is a simple page that explains how to install and use auditd.

share|improve this answer

For Linux, auditd it's a well tested solution. Windows has builtin tools for auditing file access.

Use this tools carefully, auditing can impact on the server's performance if not used wisely.

share|improve this answer
Interesting! However I am on OS X, which seems to have a slightly non-standard implementation of auditd with sparse documentation. Anyone know how to work this? – forthrin Jan 27 '14 at 7:48

Have a look at this question linux-file-access-monitoring

It mentions two ways of achieving what you need but I think the second suits better your needs:

It seems to have little dependency and provide the exact functionnality that you need.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.