Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to know which process had created any file in Linux Red Hat/CentOS 5?

share|improve this question

If you don't have any process that monitors these changes/creations than you have no way to know which process actually created a file or did anything.

This link may help you start with files auditing : Linux audit files to see who made changes to a file

In case you are a programmer you may be interested in "Monitor Linux file system events with inotify"

share|improve this answer
inotify doesn't give the process ID; you would need to use fanotify for that. – grawity May 16 '11 at 20:21

No. You can only monitor future file creation by using the auditing subsystem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.