Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite

I would like to find files accessed by specific user (even just read) within a folder tree. I thought the find command had this option, but it actually just searches for owner user. Is there any other command, or command combinations? The stat command offers access information, but doesn't display the user who made access.

share|improve this question
2  
This thread might be interesting for you: stackoverflow.com/questions/4205815/… – wollud1969 Dec 13 '12 at 14:43

2 Answers

up vote 4 down vote accepted

This information is not stored by traditional filesystems. You have three main options:

  • See who is accessing it in real time using lsof/fuser or similar;
  • Set up auditing (take a look at auditd);
  • Use something like LoggedFS.
share|improve this answer
Thank you very much. I'll take a look at auditd. – CarloAlberto Dec 13 '12 at 14:45
how does auditd compare with inotify, referenced above by wollud1969? – atroon Dec 13 '12 at 15:02
@atroon - Well, inotify can't notify you of which user did an action, so it seems irrelevant. – Chris Down Dec 13 '12 at 21:58
Huh, so 'filesytem events' does not include users. Interesting. I read the descriptions thinking it might be useful without getting into the details of precisely which events and just presumed there would be something on who had touched the file last. Thanks. – atroon Dec 14 '12 at 13:55
up vote 3 down vote

As far as I know, the only way to perform this is by activating auditd in your system. this way, it will log the access to all files and you can grep the logs files.

Be careful as the logging will be "heavy".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.