I'll also mention inotifywait
as a possibility for this. It can typically be found in the inotify-tools
package (e.g. under Ubuntu, sudo apt install inotify-tools
).
I'm going to assume that you want to monitor files in a particular directory, since monitoring everything would be a bit overwhelming. Linux is constantly reading and writing files, so you'd quickly have hundreds of entries. Even monitoring just something like /etc
would likely be too much, since so many processes need to read information there.
Let's say that you want to monitor everything in $HOME/projects
, for example. That could be done with something like:
inotifywait -d -o ~/projects-access.log --format "%w%f %T" --timefmt "%c" -e open "$HOME/projects"
That would run inotifywait
:
- In the background (
-d
)
- Outputting to
~/projects-access.log
- With the format you asked for in your Unix & Linux question (" ")
- For all files accessed (opened) under
~/projects
See man inotifywait
for details.
Caveat: Under WSL, this will only work for files in the ext4 filesystem. It will not work for files on your NTFS drives (i.e. anything under /mnt/c
, etc.). WSL2 does not currently provide support for inotify through the 9P protocol used to access Windows drives from WSL.
I believe the same will hold true for harrymc's answer of auditctl
, but I have not tested it to be sure.