I was wondering if there are any tools to keep track of the access history of a file. I know of stat, but as far as I understand, it only returns information about the last time the file was accessed.
Asked
Active
Viewed 7,516 times
2 Answers
5
Logging access times is already a fairly heavy requirement (by filesystem performance standards), because it requires a write operation for every read operation. Logging other things would be even costlier. The feature is not present in typical filesystems.
LoggedFS is a stackable filesystem that provides a view of a filesystem tree, and can perform fancier logging of all accesses through that view. To configure it, see LoggedFS configuration file syntax.
On Linux, you can use the audit subsystem to log a large number of things, including filesystem accesses. Make sure the auditd daemon is started, then configure what you want to log with auditctl. Each logged operation is recorded in /var/log/audit/audit.log (on typical distributions). To start watching a particular file:
auditctl -w /path/to/file
If you put a watch on a directory, the files in it and its subdirectories recursively are also watched.
Gilles 'SO- stop being evil'
- 829,060
0
This information is not stored in the classic filesystems, like ext2/3/4, vfat etc etc. So if you need file history you either need to use a filesystem that has this or put the file in a revision system like svn or git.
Johan
- 4,583
-
Are there such filesystems? – tshepang Aug 13 '11 at 19:57
-
1git, hg or SVN do not keep track of file access unless you retrieve the file through their interface. I am looking for something that would work for regular file access. Thanks though. – Amelio Vazquez-Reina Aug 13 '11 at 20:02