Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to tell who (which user) last modified the last file in Linux (RHEL)?

share|improve this question
up vote 5 down vote accepted

This is far from reliable, but if we are talking about shell access, you could cross-reference the file's modification time with the users logged in at that time (last) and then check their ~/.bash_history (or equivalent) for editing commands. Even grep -H filename /home/*/.bash_history could give you a starting point.

share|improve this answer

No, there is no reliable way to discover that.

The stat command shows you everything that's known about a file (except the actual contents). You can add the -Z option to get some SELinux info; but none of that tells you who modified the file last.

share|improve this answer
Yeah but no other tools to dig out ? – Raja Mar 12 '15 at 6:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.