Linux file access monitoring

Question

Is there any way in unix to find out who accessed certain file in last 1 week? It may be user or some script ftp it to some other place. Can I get a list of user name who accessed certain file? How can I find out who is accessing particular file??

Answer 1

Unless you have extremely unusual logging policies in place, who accessed what file is not logged (that would be a huge amount of information). You can find out who was logged in at what time in the system logs; the last command gives you login history, and other logs such as /var/log/auth.log will tell you how users authenticated and from where they logged in (which terminal, or which host if remotely).

The date at which a file was last read is called its access time, or atime for short. All unix filesystems can store it, but many systems don't record it, because it has a (usually small) performance penalty. ls -ltu /path/to/file or stat /path/to/file shows the file's access time.

If a user accessed the file and wasn't trying to hide his tracks, his shell history (e.g. ~/.bash_history) may have clues.

To find out what or who has a file open now, use lsof /path/to/file.

To log what happens to a file in the future, use inotifywait. inotifywait -e /path/to will print a line /path/to/ ACCESS file when someone reads file. This interface won't tell you who accessed the file; you can call lsof /path/to/file as soon as this line appears, but there's a race condition (the access may be over by the time lsof gets going).

If you really need to know who reads a file, put it on a loggedfs filesystem.

Answer 2

This is not, in general, feasible. I have seen file systems with enough auditing to make it possible one way or the other, but it is not a general Unix thing, no.

Answer 3

The previous answer is not the best practice for doing what you ask. Linux has an API for this. The inotify API http://linux.die.net/man/7/inotify

1. You can write a C program to do what you want just calling the inotify API directly
2. You can use kfsmd, http://www.linux.com/archive/feature/124903 a daemon that uses inotify
3. If you want something that works across platforms (inotify is Linux specific) and you are using Java, JNotify works across platforms(Linux, Mac, Windows), abstracting the native OS' underlying API.

Answer 4

Let me google that for you... Yes you can! This article shows how to use auditctl, ausearch, & aureport on linux kernels 2.6 and above. This one presents a fairly comprehensive guide.

I'm sure there are performance and space overhead to consider, but for anything that requires regulatory compliance or high security, it's just the cost of doing business.