Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I know who opened a particular file recently but might not have kept it opened at the moment?

Anyone has an idea?

share|improve this question
There has to be a way to find who all opened a particular file in unix.. I think this is nominal to expect from such a powerful OS. – peakit Sep 1 '09 at 17:56
keeping track of which users opened a file is not necessarily useful for most files or workloads. For example, many computers have only one user, so that user opens all the files and nobody else opens any. Many servers run a process that has its own user accounts (httpd, sql server, etc) and does not use the OS's users accounts; any files it opens are opened by the user account under which the service runs. Also for many computers keeping track of this list will cause a significant impact to performance and disk usage. Your best bet is probably, as scoopdreams suggested, to enable auditing. – Mr. Shiny and New 安宇 Sep 1 '09 at 19:05
You can't do this by default on Windows either. – pjc50 Nov 25 '09 at 14:44
up vote 2 down vote accepted

Well, if you mean in the past, you probably cannot, unless you have some kind of audtiting turned on.

Assuming you do not, you can look at the permissions of the file and the directories to see who has has access. You can grep everyone's .bash_history file for the file name.

And that is about it, as far as I know. If they still have it open, you could use lsof, for instance.

share|improve this answer

You can use auditd package as suggested in another answer. A simple use would be:

auditctl -w /etc/passwd -p war -k password-file

which will watch for write, append, read operations on this file.

You can then retrieve the audit logs through the command:

ausearch -f /etc/passwd

These examples are taken from this article which provides a fuller overview of these commands. The auditd package typically includes these commands.

If you're only interested in monitoring operations on the files, and not who actually performed those operations, you can use the inotifywatch command instead of enabling audit. This is typically available through the inotify-tools package. It records the filesystem events using linux's inotify interface.

share|improve this answer

Auditd is your friend.

Auditd man page

Not installed by default on most Linux distros yet though.

share|improve this answer

The fuser command does just that. Also, lsof does a similar job.

Note that fuser usually comes pre-installed on most distributions while lsof is less common, in my experience.

share|improve this answer
spatz, are you saying that fuser can be used to see that historically who all opened this file? – peakit Sep 1 '09 at 17:39
Not historically, right now. Maybe I misunderstood your question, but I thought you were looking for a way to see what process/user is accessing a particular file, and fuser does just that. – spatz Sep 1 '09 at 17:41
Thanks for the confirmation. – peakit Sep 1 '09 at 17:45

Another way of doing this is inotify,

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .