Is there a way to tell who (which user) last modified the last file in Linux (RHEL)?


This is far from reliable, but if we are talking about shell access, you could cross-reference the file's modification time with the users logged in at that time (last) and then check their ~/.bash_history (or equivalent) for editing commands. Even grep -H filename /home/*/.bash_history could give you a starting point.


No, there is no reliable way to discover that.

The stat command shows you everything that's known about a file (except the actual contents). You can add the -Z option to get some SELinux info; but none of that tells you who modified the file last.

  • 1
    Yeah but no other tools to dig out ? – rɑːdʒɑ Mar 12 '15 at 6:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.