I have two files under /etc/cron.d/ named j1 and j2. I make changes to those files, and in a little file the changes are gone and I don't seem to figure out who/what reverts the changes.

Is there a way to see what process/app/script did the change?


  • Is it for sure getting changed? Umm.... a program that constantly watches the files in question for any changes, like tail -f might spot the change when it happens, not sure about what changed it though. I'll bet there exists a program in debian's repos that may work, searched there? – Xen2050 Mar 30 '16 at 8:56
  • Hi! Actually I did a lot of searching and came across an auditing daemon in 2.6.x. Experimenting with that right now... – Samvel Israelian Mar 30 '16 at 9:07

These programs should watch files for changes, I haven't investigated them to see if they can tell what changes the files, but they were hits (or related) to a Ubuntu package search for what changed file

  • Changetrack (or at ubuntu

    Changetrack logs modifications of a set of files, and allows recovery of the tracked files from any stage of development. The changes are presented in a powerful web-based form, a text file, or an email message. A handful of options allow situation-specific configuration, but the code is readily available for more complex modifications.

  • Diffmon

    Tool for reporting changes in system configuration

  • filetraq

    Small utility to keep track of changes in config files

| improve this answer | |
  • (would've posted 2hrs ago but couldn't) – Xen2050 Mar 30 '16 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.