34

Is there a way to tell who (which user) last modified the last file in Linux (RHEL)?

1

2 Answers 2

20

This is far from reliable, but if we are talking about shell access, you could cross-reference the file's modification time with the users logged in at that time (last) and then check their ~/.bash_history (or equivalent) for editing commands. Even grep -H filename /home/*/.bash_history could give you a starting point.

0
18

No, there is no reliable way to discover that.

The stat command shows you everything that's known about a file (except the actual contents). You can add the -Z option to get some SELinux info; but none of that tells you who modified the file last.

1
  • 1
    Yeah but no other tools to dig out ?
    – Raja G
    Mar 12, 2015 at 6:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .