Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 2 down vote favorite

nsswitch.conf file always corrupts somehow. I do restore from my backup every time it corrupt. When this file corrupts, its time stamp is changing. Now I wonder if there is a way to track that file ? I'd like to know which process or maybe user cause that corruption. Is there a way to do that ?

share|improve this question
Have you considered involving inotify? See the questions tagged inotify (or better search for them). – manatwork Mar 12 '12 at 9:52
This might help me. Thanks – mibzer Mar 12 '12 at 9:58
As I see Solaris does not support inotify. – mibzer Mar 12 '12 at 10:05
2  
@mibzer - It would probably be a good idea to mention your operating system in your question in future. – Chris Down Mar 12 '12 at 11:07
It seems you have a bigger problem than tracking changes: You might want to investigate why your file gets corrupted in the first place. – Hai Vu Mar 13 '12 at 19:51
show 2 more comments

1 Answer

up vote 2 down vote accepted

You could either set up auditing or use DTrace. There are various examples how to use it to monitor file access on the interwebs, for example here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.