How can I see which applications have accessed a certain file within a given time period on Linux?

Posted by Nikolaidis Fotis on Server Fault See other posts from Server Fault or by Nikolaidis Fotis
Published on 2012-03-20T23:50:50Z Indexed on 2012/03/21 5:32 UTC
Read the original article Hit count: 479

Filed under:

files

|

audit

|

continuous-monitoring

Is it possible on Linux to find out which applications have accessed a certain file in the last 24 hours?

I've come with a few possible solutions:

Watch lsof. It works, but it's constrained to watch's granularity.
inotify sounds good... but no information of the application accessing the file is provided.
auditd may be useful, but I haven't checked that yet.

What ways can I see which applications have accessed a certain file within a given time period?

© Server Fault or respective owner

Related posts about files

Unzip individual files from multiple zip files and extract those individual files to home directory

as seen on Super User - Search for 'Super User'
I would like to unzip individual files. These files have a .txt extension. These files also live within multiple zipped files. Here is the command I'm trying to use. unzip -jn /path/to/zipped/files/zipArchiveFile2011\*.zip /path/to/specific/individual/files/myfiles2011*.txt -d /path/to/home/directory/for/extract/ From… >>> More
Storing image files, psd files, ai files, flash in subversion

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, Can I store large amounts of image files in subversion. My designers usually create these designs and store them anywhere on their pc and there's no system. Can I store the files in an svn repository. That way I can also protect my data against unauthorized access and its also easier to archive… >>> More
Copy files in Linux, avoid the copy if files do exist in destination

as seen on Super User - Search for 'Super User'
Hi, I need to copy a /home/user folder from one hardisk to another one. It has 100000 files and around 10G size. I use cp -r /origin /destination sometines I get some errors due to broken links, permissions and so on. So I fix the error, and need to start again the copy. I wonder how could… >>> More
Best way to convert pdf files to tiff files

as seen on Stack Overflow - Search for 'Stack Overflow'
I have around 1000 pdf filesand I need to convert them to 300 dpi tiff files. What is the best way to do this? If there is an SDK or something or a tool that can be scripted that would be ideal. >>> More
what is the difference between ELF files and bin files

as seen on Stack Overflow - Search for 'Stack Overflow'
The final images produced by compliers contain both bin file and extended loader format ELf file ,what is the difference between too , especially the utility of ELF file. >>> More

Related posts about audit

How to allow bind in app armor?

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
Question: I did setup bind9 as described here: http://ubuntuforums.org/showthread.php?p=12149576#post12149576 Now I have a little problem with apparmor: If I switch it off, it works. If apparmor runs, it doesn't work, and I get the following dmesg output: [ 23.809767] type=1400 audit(1344097913… >>> More
New in MySQL Enterprise Edition: Policy-based Auditing!

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Normal 0 false false false EN-US X-NONE X-NONE … >>> More
Configuring Granular Settings for a Database Level Audit

as seen on Internet.com - Search for 'Internet.com'
Learn how to create a database level audit at a granular level and retrieve the audit records in this 9-step tutorial. >>> More
Creating a standard audit trail in Oracle Database 11g

as seen on Internet.com - Search for 'Internet.com'
Turning on auditing is easy; knowing what to do with it is entirely different. Learn how to create a standard audit trail using Oracles Enterprise Manager. >>> More
SQL Server 2008 : Accessing Audit Details

as seen on Internet.com - Search for 'Internet.com'
Learn how to use the SQL Server 2008 catalog view and dynamic management view to access the audit details of existing server and database level audits. >>> More