Home / server / Questions / 371785
Accepted
Nikolaidis Fotis
Asked: 2012-03-21 15:50:50 +0800 CST

How can I see which applications have accessed a certain file within a given time period on Linux?

  • 772

Is it possible on Linux to find out which applications have accessed a certain file in the last 24 hours?

I've come with a few possible solutions:

  1. Watch lsof. It works, but it's constrained to watch's granularity.
  2. inotify sounds good... but no information of the application accessing the file is provided.
  3. auditd may be useful, but I haven't checked that yet.

What ways can I see which applications have accessed a certain file within a given time period?

linux monitoring files audit

1 Answers

  1. Best Answer

    auditd would be the way to go for this. Here's a quick tutorial on how to accomplish monitoring a file. You'll have to setup a watch on the file beforehand though.

    • 1