I need to know a way by which I can get which process changed a particular file the last time. Any tools or shell commands for the same would be extremely helpful.

  • Are you trying to setup a logging/auditing so you can get this data in the future, or are you trying to find the cause of an existing change. If it is the later, then I suspect you are out of luck. – Zoredache Mar 2 '12 at 2:39
  • I am trying to find the cause of an existing change, but the change will replicate itself once I remove the file. Its related to this issue serverfault.com/questions/365509/… – GeekTantra Mar 2 '12 at 2:41

See http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.