Is there any way to know which process had created any file in Linux Red Hat/CentOS 5?
-
There's a good answer to this question on the Linux StackExchange: unix.stackexchange.com/a/13791/10822– Dario SeidlSep 26, 2021 at 10:05
Add a comment
|
2 Answers
If you don't have any process that monitors these changes/creations than you have no way to know which process actually created a file or did anything.
This link may help you start with files auditing : Linux audit files to see who made changes to a file
In case you are a programmer you may be interested in "Monitor Linux file system events with inotify"
-
1
inotifydoesn't give the process ID; you would need to usefanotifyfor that.– user1686May 16, 2011 at 20:21
No. You can only monitor future file creation by using the auditing subsystem.
answered May 16, 2011 at 17:53
