Under Linux, is it possible to write a script that can count the number of times a file has been accessed in the local file system, and by whom?
How would I monitor such a thing and create a log if possible?
The audit system is a dedicated daemon which monitors filesystem resources and writes log entries to /var/log/audit.log of when a particular user accessed a file.
The auditd daemon needs to be started and reads it's configuration from /etc/auditd.conf
You can specify your own rules by using
where -p war means (w)rite, (a)ppend & (r)ead -k 'my rule name' represents the phrase that will show up in the audit log when -p war occurs
When you want to actually see which users accessed which monitored filesystem resources, use
It is certainly possible to find out the last time a file was accessed from its 'atime' attribute and there are a few ways to do this. To determine which user did it is more tricky and depends on context, e.g. was it accessed via the shell? was it accessed via a GUI app?
To see the atime of a file use
To, for instance, find all files in the /home directory that have been accessed in the last hour, you can use the
You can also get more detailed information about a file with the
In fact, here is a link to a script that checks atime (using
On rereading your question I realize that you are interested in 'how many times' a file was accessed. There is no specific *nix command to determine this info, so you will have to look into logging file access via one of the methods mentioned below.
Regarding your question about determining which users have accessed a file, *nix does not specifically log that. The assumption is that sysadmins will control access to files and directories via permissions. However, there are a few options you might try:
Note that for atime to be written to disk each time a user or process accesses it, you must have the