1

Possible Duplicate:
Access history of a file

I know if a file is "being accessed" I can use lsof to see who (which process) is accessing it, but lsof is slow and heavy and I don't think I would be able to run it fast enough to see if a file is accessed or not.

So it there a way to watch a file, and see if it ever get accessed and if yes by who?

Community
  • 1
Ali
  • 6,943

1 Answers1

2

Assuming you're running Linux:

You can use the audit subsystem to monitor access to a particular file.

You can use the inotify subsystem to watch for activities on files. There is a nice API for inotify, which makes it more useful for somethings than the audit subsystem, but inotify does not provide you with any information about who made the change that triggered a notification.

larsks
  • 34,737