Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any way to know which process had created any file in Linux Red Hat/CentOS 5?

share|improve this question

2 Answers 2

If you don't have any process that monitors these changes/creations than you have no way to know which process actually created a file or did anything.

This link may help you start with files auditing : Linux audit files to see who made changes to a file

In case you are a programmer you may be interested in "Monitor Linux file system events with inotify"

share|improve this answer
1  
inotify doesn't give the process ID; you would need to use fanotify for that. –  grawity May 16 '11 at 20:21

No. You can only monitor future file creation by using the auditing subsystem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.