Home / server / Questions / 640294
Accepted
xkcd
Asked: 2014-10-29 08:08:40 +0800 CST

How to find out which process created a particular file?

  • 772

I know that you can use lsof (in Linux at least) to check which process has got a particular file opened currently, but is there anyway to find out which process created a particular file originally? Or even which process wrote/modified a particular file most recently?

process

1 Answers

  1. Best Answer

    Auditd would help with this. See http://security.blogoverflow.com/2013/01/a-brief-introduction-to-auditd/ for an introduction.

    • 1