Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to tell who (which user) last modified the last file in Linux (RHEL)?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

This is far from reliable, but if we are talking about shell access, you could cross-reference the file's modification time with the users logged in at that time (last) and then check their ~/.bash_history (or equivalent) for editing commands. Even grep -H filename /home/*/.bash_history could give you a starting point.

share|improve this answer

No, there is no reliable way to discover that.

The stat command shows you everything that's known about a file (except the actual contents). You can add the -Z option to get some SELinux info; but none of that tells you who modified the file last.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.