Linux - How to tell which files are sourced at login?

inotifywatch may help. Packaged in inotify-tools. Use as the user of files/dir for home dir being watched, not sudo, or you'll get errors on .gvfs if running a newer gnome.

inotify will only tell you which files get accessed/created/modified/deleted.

$ inotifywatch -r /home/username/.* /home/username/*
Establishing watches...

in another terminal

$ cat /home/username/.bashrc 

in inotifywatch terminal ctrl-c to end

Finished establishing watches, now collecting statistics.
total  access  modify  close_nowrite  open  filename
3      1       0       1              1     /home/username/.bashrc

For your specific request, all files accessed during login.

$ inotifywatch -r /home/username/.* /home/username/*
Establishing watches...

in another terminal

$ sudo su
# login username

in inotifywatch terminal ctrl-c to end

You may want to redirect the inotifywatch to a file if using a fat desktop like gnome or kde. Or increase your scrollback in the inotifywatch terminal. In gnome 3, thousands of homedir files are accessed during login. You'll probably want to either exclude directories or make a specific dir/file list to watch.

You can add additional code into each dotfile, in example:

.bashrc

if [ ! -z "$PS1" ]; then # Determine whether Bash is running interactively or not.
  echo $(basename $BASH_SOURCE) loaded.
fi

and similar for .bash_profile, .bash_aliases, .profile, etc.

So when you log-in, you'll see which files are loaded and what was the exact order. If you don't want to print anything on the screen (e.g. for the users), then log it into the file instead. In example:

echo # $(basename $BASH_SOURCE) loaded for $USER. >> ~/.bash_history

You can check the above solution in my dotfiles.

One way, rather inefficient way, is to boot the computer, have the person login. Then mount the drive with noatime so the access time doesn't get updated anymore, then use find to dump a list of files accessed in the time period the user logged in.