How can I know who opened a particular file recently but might not have kept it opened at the moment?
Anyone has an idea?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
Well, if you mean in the past, you probably cannot, unless you have some kind of audtiting turned on.
Assuming you do not, you can look at the permissions of the file and the directories to see who has has access. You can grep everyone's .bash_history file for the file name.
And that is about it, as far as I know. If they still have it open, you could use lsof, for instance.
You can use auditd package as suggested in another answer. A simple use would be:
auditctl -w /etc/passwd -p war -k password-file
which will watch for write, append, read operations on this file.
You can then retrieve the audit logs through the command:
ausearch -f /etc/passwd
These examples are taken from this article which provides a fuller overview of these commands. The auditd package typically includes these commands.
If you're only interested in monitoring operations on the files, and not who actually performed those operations, you can use the inotifywatch command instead of enabling audit. This is typically available through the inotify-tools package. It records the filesystem events using linux's inotify interface.
Auditd is your friend.
Not installed by default on most Linux distros yet though.
Another way of doing this is inotify, http://www.ibm.com/developerworks/linux/library/l-inotify.html