I have a set-up a server running several applications. There will be multiple people using these applications in a community situation. I am looking for a way to track and report changes made to certain files and dirs. There is already a MTA setup, so I am looking for a way to generate logs of activity on specified locations and then mail them once a day. Can anyone offer any advice on where to start?


If you know the processes that you want to monitor then you can use "lsof" command to see the file a particular process or command is using. Please see below for an example :

$$ lsof -p "pid_of_process"

Even if you do not know about process then also you can use lsof periodically to collect system information about files used by a process.

If you are interested in complete system activity, then "sar" utility should be used

  • I see that lsof can track what processes make changes to certain dir. Can I use it too buid a report of what files were added or removed? With something like lsof +D /var/log/ -u USER -a ? – Tom Ruh Apr 7 '15 at 18:59
  • @TomRuh, I dont think that for added or removed files you should use lsof. Because lsof gives list of open files only. If there are files that are not opened at a particular instance then that will not be shown . I think that following post is useful for your case link – shubham Apr 8 '15 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.