Is there any way in unix to find out who accessed certain file in last 1 week? It may be user or some script ftp it to some other place. Can I get a list of user name who accessed certain file? How can I find out who is accessing particular file??
Unless you have extremely unusual logging policies in place, who accessed what file is not logged (that would be a huge amount of information). You can find out who was logged in at what time in the system logs; the
last command gives you login history, and other logs such as
/var/log/auth.log will tell you how users authenticated and from where they logged in (which terminal, or which host if remotely).
The date at which a file was last read is called its access time, or atime for short. All unix filesystems can store it, but many systems don't record it, because it has a (usually small) performance penalty.
ls -ltu /path/to/file or
stat /path/to/file shows the file's access time.
If a user accessed the file and wasn't trying to hide his tracks, his shell history (e.g.
~/.bash_history) may have clues.
To find out what or who has a file open now, use
To log what happens to a file in the future, there are a few ways:
inotifywait -e access /path/towill print a line
/path/to/ ACCESS filewhen someone reads
file. This interface won't tell you who accessed the file; you can call
lsof /path/to/fileas soon as this line appears, but there's a race condition (the access may be over by the time lsof gets going).
LoggedFS is a stackable filesystem that provides a view of a filesystem tree, and can perform fancier logging of all accesses through that view. To configure it, see LoggedFS configuration file syntax.
You can use Linux's audit subsystem to log a large number of things, including filesystem accesses. Make sure the
auditddaemon is started, then configure what you want to log with
auditctl. Each logged operation is recorded in
/var/log/audit/audit.log(on typical distributions). To start watching a particular file:
auditctl -w /path/to/file
If you put a watch on a directory, the files in it and its subdirectories recursively are also watched.
Above example with inotifywait should be one of (see man page for more info):
inotifywait /path/to/file inotifywait -e open /pat/to/file
Or with monitoring mode and timestamp:
inotifywait -m --format '%w:%e:%T' --timefmt '%F %T %Z %z'
The previous answer is not the best practice for doing what you ask.
Linux has an API for this. The
inotify API http://linux.die.net/man/7/inotify
- You can write a C program to do what you want just calling the
- You can use kfsmd, http://www.linux.com/archive/feature/124903 a daemon that uses
- If you want something that works across platforms (
inotifyis Linux specific) and you are using Java, JNotify works across platforms(Linux, Mac, Windows), abstracting the native OS' underlying API.
This is not, in general, feasible. I have seen file systems with enough auditing to make it possible one way or the other, but it is not a general Unix thing, no.