Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Three files have suddenly appeared in my home directory, called "client_state.xml", "lockfile", and "time_stats_log". The last two are empty. I'm wondering how they got there. It's not the first time it has happened, but the last time was weeks ago; I deleted the files and nothing broke or complained. I haven't been able to think of what I was doing at the time reported by stat $filename. Is there any way I can find out where they came from?

Alternatively, is there a way to monitor the home directory (but not sub-directories) for the creation of files?

share|improve this question
Since I'm sure someone will mention it, I don't have inotify. –  Wolf Jan 18 '11 at 19:46
add comment

4 Answers

up vote 8 down vote accepted

I don't believe there is a way to determine which program created a file once it exists. You can watch for the file to be recreated, though, using inotify. inotifywait is a command-line interface for the inotify subsystem; you can tell it to look for create events in your home directory:

$ (sleep 5; touch ~/making-a-test-file) &
[1] 22526

$ inotifywait -e create ~/
Setting up watches.
Watches established.
/home/mmrozek/ CREATE making-a-test-file

You probably want to run it with -m (monitor), which tells it not to exit after it sees the first event

share|improve this answer
How do I get inotify? It's not installed (kernel 2.6.34) and there's no /dev/inotify. –  Wolf Jan 18 '11 at 19:52
@Wolf What distro? If you build your own kernel, it's CONFIG_INOTIFY_USER (Filesystems -> Inotify support for userspace). inotifywait is probably in a package named something like inotify-tools –  Michael Mrozek Jan 18 '11 at 20:01
@Michael, it's openSUSE 11.3. I've never built a kernel; have only been using Linux about 5 months and it's a bit of a daunting concept. But I'll look around for a tutorial or something. –  Wolf Jan 18 '11 at 20:03
@Wolf Well, dogbane's answer might be easier if the kernel you have doesn't come with it –  Michael Mrozek Jan 18 '11 at 20:07
@Michael Actually, after a little more hunting and research, I added a community repository which, it turns out, contains the inotify-tools package, so I now have inotifywait (and inotifywatch). I tested it out and it seems to work. –  Wolf Jan 18 '11 at 20:46
show 2 more comments

You can watch everything that happens on a filesystem by accessing it over LoggedFS. This is a stacked filesystem that logs every access in a directory tree.

loggedfs -l /var/tmp/$USER-home-fs.log ~

Logging your whole home directory might slow your system down though. You'll at least want to write a configuration file with stringent filters.

If you have root access, on Linux, you can use the audit subsystem to log a large number of things, including filesystem accesses. Make sure the auditd daemon is started, then configure what you want to log with auditctl. Each logged operation is recorded in /var/log/audit/audit.log (on typical distributions). To start watching a particular file:

auditctl -w /path/to/file

or in the long form

auditctl -a exit,always -F path=/path/to/file

If you put a watch on a directory (with -w or -F dir=), the files in it and its subdirectories recursively are also watched.

share|improve this answer
BSD also supports this via Security Event Auditing. freebsd.org/doc/en_US.ISO8859-1/books/handbook/audit.html –  Shawn J. Goff Oct 12 '11 at 17:32
add comment

You haven't got inotify so you can write a script that checks for the file in a loop:


while [ true ]; do                     # Run for as long as nessesary
  if [ -f /path/to/file ]; then        # If fileexists
    echo "Found file"                  # Notify and stop monitoring
    exit 0
  sleep 5                             # Else wait 5 secs
share|improve this answer
add comment

You might want to take a look at auditd - this package allows you to do security auditing, and get a lot of information about who changed what in the filesystem.

share|improve this answer
if you have a server that provides shell access for multiple users, and need to provide some level of accountability for individual actions, you can build certain shells (like bash and tcsh) with command history logging. I wrote a blog post about logging in shells at <timkennedy.net/2010/12/07/…;. Shell logging is not a replacement for a real auditing system, as it won't log commands run by non-interactive shells (like scripts or programs). To get that sort of granularity you really need a good auditing solution. –  Tim Kennedy Oct 13 '11 at 14:22
@TimKennedy - your blog post isn't coming up anymore. –  slm Aug 29 '13 at 18:36
Sorry. site got hacked, and was down for a while. new page is at timkennedy.net/2010/12/logging-shell-commands-to-syslog-on.html –  Tim Kennedy Nov 14 '13 at 18:24
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.