Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This question already has an answer here:

Is there log which record the operation of files in linux. Just like, if some users rename or delete or add some files, can root user see the records of the operations. Do these logs exists in linux. Thx

share|improve this question

marked as duplicate by Karan, gronostaj, mpy, Ƭᴇcʜιᴇ007, Sathya Jul 13 '13 at 18:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3 Answers 3

Not by default. The kernel has an audit framework for this, but it must be manually enabled.

share|improve this answer

If you're root, you can find them in the users' .bash_history files (assuming they're using Bash as the shell; other shells keep their histories elsewhere).

share|improve this answer

.bash_history file in home folder of each user contains only commands that were entered by this user in console (end executed as well, that wend wrong does not get in that file), it is not about file operations. Also, the same information you could get by history command.

I think it is impossible to get exactly the history of file operations, but what you can achieve is to get all file operations for each command that you want - use strace for it. Like strace -e trace=open groupadd blabla.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.