This question already has an answer here:

I remember long time ago I had some antivirus on windows which had wile accesses monitor, and could tell you if any process accesses a file.I need to monitor every file in my home folder(or any other) what application does the actions.

marked as duplicate by Gilles, jasonwryan, don_crissti, slm Mar 13 '15 at 0:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


If you are using Linux, this sounds like a job for fatrace (which uses the fanotify API). Here is some sample output:

sh(28980): C /bin/bash
cron(28974): CW /tmp/tmpf807Y78 (deleted)
cron(28974): C /lib/x86_64-linux-gnu/security/pam_unix.so
cron(28974): C /lib/x86_64-linux-gnu/libcrypt-2.13.so
cron(28974): C /lib/x86_64-linux-gnu/security/pam_deny.so

This tells us, for example, that cron did a close-write on /tmp/tmpf807Y78.

If fatrace turns out not to be adequate for your use case, you could look up alternative clients of the fanotify API.


You should try out inotifywait, from the [inotify-tools][1] package, if you're using Linux. A command like this:

inotifywait -m -r $HOME

running in an xterm should give you an idea of what's going on. It looks like "what application does the actions" is not available, however.

Not the answer you're looking for? Browse other questions tagged or ask your own question.