Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Access history of a file

I know if a file is "being accessed" I can use lsof to see who (which process) is accessing it, but lsof is slow and heavy and I don't think I would be able to run it fast enough to see if a file is accessed or not.

So it there a way to watch a file, and see if it ever get accessed and if yes by who?

share|improve this question

marked as duplicate by Gilles, Caleb, Michael Mrozek Feb 23 '12 at 7:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 1 down vote accepted

Assuming you're running Linux:

You can use the audit subsystem to monitor access to a particular file.

You can use the inotify subsystem to watch for activities on files. There is a nice API for inotify, which makes it more useful for somethings than the audit subsystem, but inotify does not provide you with any information about who made the change that triggered a notification.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.