Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I was wondering if there are any tools to keep track of the access history of a file. I know of stat, but as far as I understand, it only returns information about the last time the file was accessed.

share|improve this question

marked as duplicate by Gilles files May 27 '15 at 22:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 3 down vote accepted

Logging access times is already a fairly heavy requirement (by filesystem performance standards), because it requires a write operation for every read operation. Logging other things would be even costlier. The feature is not present in typical filesystems.

LoggedFS is a stackable filesystem that provides a view of a filesystem tree, and can perform fancier logging of all accesses through that view. To configure it, see LoggedFS configuration file syntax.

On Linux, you can use the audit subsystem to log a large number of things, including filesystem accesses. Make sure the auditd daemon is started, then configure what you want to log with auditctl. Each logged operation is recorded in /var/log/audit/audit.log (on typical distributions). To start watching a particular file:

auditctl -w /path/to/file

If you put a watch on a directory, the files in it and its subdirectories recursively are also watched.

share|improve this answer

This information is not stored in the classic filesystems, like ext2/3/4, vfat etc etc. So if you need file history you either need to use a filesystem that has this or put the file in a revision system like svn or git.

share|improve this answer
Are there such filesystems? – Tshepang Aug 13 '11 at 19:57
git, hg or SVN do not keep track of file access unless you retrieve the file through their interface. I am looking for something that would work for regular file access. Thanks though. – Amelio Vazquez-Reina Aug 13 '11 at 20:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.