How to find, from where/which program using the log file and updating the entries/filling the log file in Linux.
There is not simple answer to this, things you have available are these:
You can use
inotify to get notified whenever something changes a file.
inotify itself is not a utility, it's an interface that's provided by the Linux kernel, but there are utilities like for example
inotifywait from the
The problem with
inotify is that it does not tell you which process has modified the file.
mst@mst-nb1:~$ inotifywait 123 Setting up watches. Watches established. # now i write to "123" in another terminal 123 MODIFY
One really great utility to figure out which process holds a file open is
lsof. For example by doing
lsof /var/log/syslog you can see which processes currently hold that file open.
The problem with
lsof is that it cannot monitor that file over a time span, it can only give you a snapshot of the situation at the moment when you run it. In your case you want to know what's writing to that file, but you don't know for sure whether that file is permanently held open (most likely it's not). In case the writing process does not keep the file open all the time, then
lsof won't help you much because it could only point you to the right process if you run it exactly at the moment when it's writing.
The reason why
lsof can't monitor the file the same was as
inotify does is because it gets it's information by simply scanning through the
/proc filesystem, but it does not setup any watchers.
# Terminal 1 (I open the file) mst@mst-nb1:~$ cat > 123 # Terminal 2 mst@mst-nb1:~$ lsof 123 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME cat 24097 mst 1w REG 252,1 0 16791997 123
This might be your best chance, but it takes quite some effort to make it work. You can use fuse's
loggedfs and mount it in the directory where your log file resides. Then it should give you detailed information about what's opening a file and when.
The only problem with
loggedfs is that it is not as easy to use as some simple command line utility.
If you want to go through the hassle with
loggedfs you can refer to the documentation
The conclusion is that you have various possibilities, but there's no
Log files get their input from multiple sources. They are usually structured as lines, with the first word stating the source, timestamps, and some message.
There isn't a rigid format, each application (for example, Web server) has its own files, with their own formats (and often specific tools to summarize or otherwise mangle their contents).
Here is a simple way: auditd.
-w /var/tmp/foo -p w -k foo
Here is an entry in /var/log/audit/audit.log:
type=SYSCALL msg=audit(1454353834.695:29): arch=c000003e syscall=2 success=yes exit=3 a0=27cd460 a1=241 a2=1a4 a3=7fff4e278f30 items=2 ppid=10218 pid=10314 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="vi" exe="/usr/bin/vim.basic" key="foo"
There is a good amount of information there including pid and executable. See also