Is it possible on Linux to find out which applications have accessed a certain file in the last 24 hours?

I've come with a few possible solutions:

  1. Watch lsof. It works, but it's constrained to watch's granularity.
  2. inotify sounds good... but no information of the application accessing the file is provided.
  3. auditd may be useful, but I haven't checked that yet.

What ways can I see which applications have accessed a certain file within a given time period?

  • I assume that you're using a posix operating system since you mention lsof and other utilities. – Wesley Mar 21 '12 at 0:23

auditd would be the way to go for this. Here's a quick tutorial on how to accomplish monitoring a file. You'll have to setup a watch on the file beforehand though.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.