Home / server / Questions / 43978
Accepted
Umber Ferrule
Asked: 2009-07-23 03:50:41 +0800 CST

In Linux, is there a way of seeing which user updated a file?

  • 772

Does Linux record who last changed a file (rather than created it)? If so, how do I find this out? If not, is there some way of monitoring file(s)?

linux filesystems users

3 Answers

  1. Best Answer

    See who made changes to a file

    Install the audit package using the package manager for your distribution and start the service.

    Set a watch for a file you're interested in, such as /etc/passwd

    # auditctl -w /etc/passwd -p war -k password-file

    See the audit records for that file

    # ausearch -f /etc/passwd | less
    • 14

  2. Generally, no. I've never tried it, but if you want to track users accessing particular file, you can take a look at audit

    • 1

  3. No, there's no record keeping of who modified which file.

    To give you an idea, you might check the logs to see who was logged in at that time, and under ideal circumstances, history files can examined.

    • 0