Script to count number of times a file has been accessed

Question

Under Linux, is it possible to write a script that can count the number of times a file has been accessed in the local file system, and by whom?

How would I monitor such a thing and create a log if possible?

Answer 1

The audit system is a dedicated daemon which monitors filesystem resources and writes log entries to /var/log/audit.log of when a particular user accessed a file.

The auditd daemon needs to be started and reads it's configuration from /etc/auditd.conf

You can specify your own rules by using auditctl, e.g.

$ sudo auditctl -w /etc/passwd -p war -k passwd-file

where -p war means (w)rite, (a)ppend & (r)ead -k 'my rule name' represents the phrase that will show up in the audit log when -p war occurs

When you want to actually see which users accessed which monitored filesystem resources, use auditsearch and auditreport to filter the logs for 'my rule name' entries and a summary report respectively.

Answer 2

It is certainly possible to find out the last time a file was accessed from its 'atime' attribute and there are a few ways to do this. To determine which user did it is more tricky and depends on context, e.g. was it accessed via the shell? was it accessed via a GUI app?

To see the atime of a file use ls with the -u option:

$ ls -lu some_file

To, for instance, find all files in the /home directory that have been accessed in the last hour, you can use the find command

$ sudo find /home/ -amin -60

You can also get more detailed information about a file with the stat command:

$ stat some_file

In fact, here is a link to a script that checks atime (using stat) for files in a specified directory.

On rereading your question I realize that you are interested in 'how many times' a file was accessed. There is no specific *nix command to determine this info, so you will have to look into logging file access via one of the methods mentioned below.

Regarding your question about determining which users have accessed a file, *nix does not specifically log that. The assumption is that sysadmins will control access to files and directories via permissions. However, there are a few options you might try:

1. use ps and fuser to see which users are currently accessing files
2. force users to use sudo to access files - sudo logs to the file /var/log/auth.log - although this option can be a serious productivity (and trust) killer
3. look into SElinux ACLs and logging
4. modify (with aliases) the system-wide shell profile (/etc/profile) to log atime and user info to a dedicated log file
5. as suggested in a comment to your question, write a shell script to log atime and user info and use this script to wrap GUI apps (i.e modify the 'command' entry in the launcher

Note that for atime to be written to disk each time a user or process accesses it, you must have the atime option included in that filesystem's /etc/fstab entry (discussed here)