Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Under Linux, is it possible to write a script that can count the number of times a file has been accessed in the local file system, and by whom?

How would I monitor such a thing and create a log if possible?

share|improve this question
A shell script could not perform this monitoring. E.G. opening a file using a GUI app would not be detected by a shell script. There would have to be hooks into the filesystem (or a callback function) every time a file is opened. It's possible if you hack into the kernel but all this this would have to preserve kernel security/integrity. – sawdust Dec 29 '11 at 8:52

The audit system is a dedicated daemon which monitors filesystem resources and writes log entries to /var/log/audit.log of when a particular user accessed a file.

The auditd daemon needs to be started and reads it's configuration from /etc/auditd.conf

You can specify your own rules by using auditctl, e.g.

$ sudo auditctl -w /etc/passwd -p war -k passwd-file

where -p war means (w)rite, (a)ppend & (r)ead -k 'my rule name' represents the phrase that will show up in the audit log when -p war occurs

When you want to actually see which users accessed which monitored filesystem resources, use auditsearch and auditreport to filter the logs for 'my rule name' entries and a summary report respectively.

share|improve this answer
Thanks for making it clear venzen .. :) – Gaara Jan 2 '12 at 4:53

It is certainly possible to find out the last time a file was accessed from its 'atime' attribute and there are a few ways to do this. To determine which user did it is more tricky and depends on context, e.g. was it accessed via the shell? was it accessed via a GUI app?

To see the atime of a file use ls with the -u option:

$ ls -lu some_file

To, for instance, find all files in the /home directory that have been accessed in the last hour, you can use the find command

$ sudo find /home/ -amin -60

You can also get more detailed information about a file with the stat command:

$ stat some_file

In fact, here is a link to a script that checks atime (using stat) for files in a specified directory.

On rereading your question I realize that you are interested in 'how many times' a file was accessed. There is no specific *nix command to determine this info, so you will have to look into logging file access via one of the methods mentioned below.

Regarding your question about determining which users have accessed a file, *nix does not specifically log that. The assumption is that sysadmins will control access to files and directories via permissions. However, there are a few options you might try:

  1. use ps and fuser to see which users are currently accessing files
  2. force users to use sudo to access files - sudo logs to the file /var/log/auth.log - although this option can be a serious productivity (and trust) killer
  3. look into SElinux ACLs and logging
  4. modify (with aliases) the system-wide shell profile (/etc/profile) to log atime and user info to a dedicated log file
  5. as suggested in a comment to your question, write a shell script to log atime and user info and use this script to wrap GUI apps (i.e modify the 'command' entry in the launcher

Note that for atime to be written to disk each time a user or process accesses it, you must have the atime option included in that filesystem's /etc/fstab entry (discussed here)

share|improve this answer
Hi venzen, thanks for the reply, Well actually I am running a server which does not have a X-Server so GUI wont be a problem, but thanks for the heads up :) Sorry for not mentioning it before. Well, I also thought about the atime option but was not able to relate it well. Well I came across a tool called audit auditd is the daemon that will be running, with auditctl you can monitor specific files and ausearch will show the output of who has accessed the file and shows many more information. I can write a script which filters data from the information from ausearch. Any Views? – Gaara Dec 30 '11 at 9:46
great. thanks for explaining your solution - i was not aware that audit could do this. so now we both know. For the sake of other (future) users who find this question I will add another answer (since you can't) which outlines audit as a solution. kindly accept my answer in the spirit of ubuntu - that will be your xmas gift to me :D – venzen Dec 30 '11 at 11:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .