How to find, from where/which program using the log file and updating the entries/filling the log file in Linux.

  • 2
    Welcome to Unix&Linux: Would you please update the post and explain better what you want? Please try to not use one liners. If your command of English is weak, adding to the post will help others understand your needs and correct it. – Rui F Ribeiro Jan 25 '16 at 7:21
  • Your question inspired me to write an article about that topic, so here it is mauro-stettler.blogspot.com/2016/01/… – replay Feb 1 '16 at 7:51

There is not simple answer to this, things you have available are these:


You can use inotify to get notified whenever something changes a file. inotify itself is not a utility, it's an interface that's provided by the Linux kernel, but there are utilities like for example inotifywait from the inotify-tools package.

The problem with inotify is that it does not tell you which process has modified the file.


mst@mst-nb1:~$ inotifywait 123
Setting up watches.
Watches established.    # now i write to "123" in another terminal


One really great utility to figure out which process holds a file open is lsof. For example by doing lsof /var/log/syslog you can see which processes currently hold that file open.

The problem with lsof is that it cannot monitor that file over a time span, it can only give you a snapshot of the situation at the moment when you run it. In your case you want to know what's writing to that file, but you don't know for sure whether that file is permanently held open (most likely it's not). In case the writing process does not keep the file open all the time, then lsof won't help you much because it could only point you to the right process if you run it exactly at the moment when it's writing.

The reason why lsof can't monitor the file the same was as inotify does is because it gets it's information by simply scanning through the /proc filesystem, but it does not setup any watchers.


# Terminal 1 (I open the file)
mst@mst-nb1:~$ cat > 123

# Terminal 2
mst@mst-nb1:~$ lsof 123
cat     24097  mst    1w   REG  252,1        0 16791997 123


This might be your best chance, but it takes quite some effort to make it work. You can use fuse's loggedfs and mount it in the directory where your log file resides. Then it should give you detailed information about what's opening a file and when.

The only problem with loggedfs is that it is not as easy to use as some simple command line utility.

If you want to go through the hassle with loggedfs you can refer to the documentation


The conclusion is that you have various possibilities, but there's no simple way.

  • Hello Mauro...The question is not clear at all, and you have had a lot of work. as the question is asked, and how you talk about monitoring /var/log/syslog...the obvious answer is syslog-ng, or rsyslog. No need to monitor for that. What you should be talking about is /dev/log. Btw I actually am not fond of fuse. Have a look at sysdig.org Cheers – Rui F Ribeiro Jan 25 '16 at 7:28
  • You're right about that if he's using syslog. But according to the question this file could be written by literally anything. (I'm not fan of fuse either btw) – replay Jan 25 '16 at 7:29
  • read better what I wrote. Programs talking to the syslog service use /dev/log, and syslog-ng, rsyslog or whatever is the one that writes by proxy to /var/log/syslog and family. I am just commenting on your post, it is not clear at all what the OP wants, and I wont waste my energy trying to guess. – Rui F Ribeiro Jan 25 '16 at 7:30
  • true true, was an interesting exercise for myself anyway – replay Jan 25 '16 at 7:31
  • 2
    Actually to be totally correct, programs write to /dev/log OR to port 514/UDP to send logs to the syslog daemon. sysdig can monitor all of this. – Rui F Ribeiro Jan 25 '16 at 7:34

Log files get their input from multiple sources. They are usually structured as lines, with the first word stating the source, timestamps, and some message.

There isn't a rigid format, each application (for example, Web server) has its own files, with their own formats (and often specific tools to summarize or otherwise mangle their contents).


Here is a simple way: auditd.



-w /var/tmp/foo -p w -k foo

Here is an entry in /var/log/audit/audit.log:

type=SYSCALL msg=audit(1454353834.695:29): 
arch=c000003e syscall=2 success=yes exit=3 a0=27cd460 a1=241 a2=1a4
a3=7fff4e278f30 items=2 ppid=10218 pid=10314 auid=0 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=3 comm="vi"
exe="/usr/bin/vim.basic" key="foo"

There is a good amount of information there including pid and executable. See also aureport.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.