Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any file system - or monitoring tool - which logs which users have read and written which files?

Something like this:

2014-01-21 13:45:45  john  12939  /users/john/hello.txt   write
2014-01-21 13:45:55  paul  12939  /users/john/hello.txt   read

This should be restrictable to certain folders (only user files are interesting, not system files).

share|improve this question

3 Answers 3

You can try to install auditd. It is a useful tool to setup watches for specific files/folders operations. It support different operations: r=read, w=write, x=execute, a=attribute.

You can add a specific watch with a specific filter key for easy search.

Here is a simple page that explains how to install and use auditd.

share|improve this answer

For Linux, auditd it's a well tested solution. Windows has builtin tools for auditing file access.

Use this tools carefully, auditing can impact on the server's performance if not used wisely.

share|improve this answer
    
Interesting! However I am on OS X, which seems to have a slightly non-standard implementation of auditd with sparse documentation. Anyone know how to work this? –  forthrin Jan 27 at 7:48

Have a look at this question linux-file-access-monitoring

It mentions two ways of achieving what you need but I think the second suits better your needs:

http://loggedfs.sourceforge.net/

It seems to have little dependency and provide the exact functionnality that you need.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.