Is there any way to know which process had created any file in Linux Red Hat/CentOS 5?


2 Answers 2


If you don't have any process that monitors these changes/creations than you have no way to know which process actually created a file or did anything.

This link may help you start with files auditing : Linux audit files to see who made changes to a file

In case you are a programmer you may be interested in "Monitor Linux file system events with inotify"

  • 1
    inotify doesn't give the process ID; you would need to use fanotify for that.
    – user1686
    May 16, 2011 at 20:21

No. You can only monitor future file creation by using the auditing subsystem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.