3

Is there any way to "view" (or) "store" file history (similar to browser history). For example if I have 10 files, and I open 2 of them, the following 2 details should get stored in a file:

<name-of-file-opened> <date-and-time>

This should happen whenever I open a file. So when I open that particular history file, I can see all the files that I have opened (not necessarily edited -- just if I have opened).

I know lsof is for viewing the list of all currently open files, but is there any way to get a "history". If there is no in-built command for this, is it possible to create a custom command for the same purpose?

7
  • 1
    What do you mean by "file history"? What do you need to do to a file that adds it to this history? Jul 19, 2021 at 15:26
  • That's for reposting this over here (although I still think the Unix & Linux stack would be a better alternative). Please remember to delete your Stack Overflow question as double-posting is generally frowned on here. I'll copy my comment from there over here as well -- Please edit your question to explain what you mean by "file history"? Give some examples of the results you'd like to see. Do you mean "see all changes to any file in Linux"? "See the history of when a particular file was changed"? Or what? Thanks! Jul 19, 2021 at 16:37
  • @NottheDr01ds Sorry I am new to Stack Exchange. I have edited the question in Unix and Linux stack.
    – kkk
    Jul 19, 2021 at 16:49
  • No worries - We're all new at some point! :-). I didn't see the "Unix & Linux" one since it wasn't tagged windows-subsystem-for-linux there (and that's what I normally look for by default). Can you confirm that you are using WSL? That's an important detail for the question as well. Jul 19, 2021 at 16:59
  • @NotTheDr01ds Yes I am using WSL ..
    – kkk
    Jul 20, 2021 at 6:27

2 Answers 2

1

I'll also mention inotifywait as a possibility for this. It can typically be found in the inotify-tools package (e.g. under Ubuntu, sudo apt install inotify-tools).

I'm going to assume that you want to monitor files in a particular directory, since monitoring everything would be a bit overwhelming. Linux is constantly reading and writing files, so you'd quickly have hundreds of entries. Even monitoring just something like /etc would likely be too much, since so many processes need to read information there.

Let's say that you want to monitor everything in $HOME/projects, for example. That could be done with something like:

inotifywait -d -o ~/projects-access.log  --format "%w%f %T" --timefmt "%c" -e open "$HOME/projects"

That would run inotifywait:

  • In the background (-d)
  • Outputting to ~/projects-access.log
  • With the format you asked for in your Unix & Linux question (" ")
  • For all files accessed (opened) under ~/projects

See man inotifywait for details.

Caveat: Under WSL, this will only work for files in the ext4 filesystem. It will not work for files on your NTFS drives (i.e. anything under /mnt/c, etc.). WSL2 does not currently provide support for inotify through the 9P protocol used to access Windows drives from WSL.

I believe the same will hold true for harrymc's answer of auditctl, but I have not tested it to be sure.

1

Linux does not track file history information.

You will need to configure auditing to track changes to specific files.

Some notes:

  • Audit only does future changes
  • Auditing a deleted file may cause problem to the daemon.

Look for auditctl.

Some random references (many more can be found):

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .