Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to see who (in the group) has accessed a certain directory on a Linux or Unix machine?

What is the command?

share|improve this question
    
What do you mean? To know who use opened files in some directory you may use commands lsof or fuser. If you want to know, who had open/edit files in past, I need to disappoint you: it's impossible! –  Eddy_Em Mar 26 '13 at 5:03
    
I mean, I have a directory under ~/my_user/ that is 'read/write-able' to people in my group. I'm am required to let them read it, and possibly write to it. But I am a bit paranoid that people will change things in it without letting me know. So I'm interested in seeing the history of change in the directory. I thought of check it into git, but then they can always delete the .git file, and there's gone the history! –  One Two Three Mar 26 '13 at 17:11
    
You can use VCS saving its files in other place, where that users can't write. –  Eddy_Em Mar 26 '13 at 17:26
add comment

2 Answers

up vote 1 down vote accepted

Check the user's ~/.bash_history file and see if they have a cd to the folder you're checking out. This works if they weren't paranoid.

stat -c 'Owner: %U / Access_rights: %A / Last_access %x' ~/ will print the owner username and access rights for your home directory. Change ~/ to the folder that you're interested in.

last will give you user login history with dates/times.

You can match all of these things together to get a good idea of the last user who looked at it.

share|improve this answer
    
I think you understand what I meant, thank you! :) –  One Two Three Mar 26 '13 at 17:03
    
The first command shows me the timestamp when it was last accessed, but it doesn't say who. But unfortunately, there are A LOT of users on my system, hence, last doesn't help much ... Do you happen to know some other trick? –  One Two Three Mar 26 '13 at 17:08
add comment

Take a look at the inotifywatch, it listens for filesystem events then outputs a summary count of the events received on each file or directory

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.