6

Is there any way to know which process had created any file in Linux Red Hat/CentOS 5?

1

2 Answers 2

2

If you don't have any process that monitors these changes/creations than you have no way to know which process actually created a file or did anything.

This link may help you start with files auditing : Linux audit files to see who made changes to a file

In case you are a programmer you may be interested in "Monitor Linux file system events with inotify"

1
  • 1
    inotify doesn't give the process ID; you would need to use fanotify for that. May 16, 2011 at 20:21
1

No. You can only monitor future file creation by using the auditing subsystem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .