Is it possible to find out what program or script created a given file?

Question

Three files have suddenly appeared in my home directory, called "client_state.xml", "lockfile", and "time_stats_log". The last two are empty. I'm wondering how they got there. It's not the first time it has happened, but the last time was weeks ago; I deleted the files and nothing broke or complained. I haven't been able to think of what I was doing at the time reported by stat $filename. Is there any way I can find out where they came from?

Alternatively, is there a way to monitor the home directory (but not sub-directories) for the creation of files?

Answer 1

I don't believe there is a way to determine which program created a file once it exists. You can watch for the file to be recreated, though, using inotify. inotifywait is a command-line interface for the inotify subsystem; you can tell it to look for create events in your home directory:

$ (sleep 5; touch ~/making-a-test-file) &
[1] 22526

$ inotifywait -e create ~/
Setting up watches.
Watches established.
/home/mmrozek/ CREATE making-a-test-file

You probably want to run it with -m (monitor), which tells it not to exit after it sees the first event

Answer 2

You can watch everything that happens on a filesystem by accessing it over LoggedFS. This is a stacked filesystem that logs every access in a directory tree.

loggedfs -l /var/tmp/$USER-home-fs.log ~

Logging your whole home directory might slow your system down though. You'll at least want to write a configuration file with stringent filters.

If you have root access, on Linux, you can use the audit subsystem to log a large number of things, including filesystem accesses. Make sure the auditd daemon is started, then configure what you want to log with auditctl. Each logged operation is recorded in /var/log/audit/audit.log (on typical distributions). To start watching a particular file:

auditctl -w /path/to/file

or in the long form

auditctl -a exit,always -F path=/path/to/file

If you put a watch on a directory (with -w or -F dir=), the files in it and its subdirectories recursively are also watched.

Answer 3

You haven't got inotify so you can write a script that checks for the file in a loop:

#!/bin/sh

while [ true ]; do                     # Run for as long as nessesary
  if [ -f /path/to/file ]; then        # If fileexists
    echo "Found file"                  # Notify and stop monitoring
    exit 0
  fi
  sleep 5                             # Else wait 5 secs
done

Answer 4

You might want to take a look at auditd - this package allows you to do security auditing, and get a lot of information about who changed what in the filesystem.