I am looking a way to to get the history of a file, like the modification date, who modified this file (ip address or username), the changed lines

Is there a way to get the IP address or username of who modified a file in linux?

  • 1
    Unless you enabled auditing, this is not possible. Of course if you are using SELinux, this might be turned on by default, but again hard to tell specifics about your situation from afar
    – MelBurslan
    Feb 11, 2016 at 17:04
  • Sorry, I just got past the edit option for my previous comment. If you are facing someone doing a mischef on your system, and you don't have the auditing enabled, the best you can do, is check file modification date, run command last and map the users who were logged in that time. Then you can browse their .bash_history files to see what commands they ran. Not a sure-fire way but at least a glimmer of hope.
    – MelBurslan
    Feb 11, 2016 at 17:16

3 Answers 3


Not likely in one step, but you can see who logged into a system using w and you can match the modification times of the files shown by stat with the logged in time of the user. If the file isn't 777, you can also consider the permissions of the given user to filter this down to only people able to edit the file. Otherwise, look into auditing file system events.


To monitor user login history you can try Utmpdump . It will give you users,times,ipaddresses of logins

to display the contents of /var/run/utmp, run the following command:

utmpdump /var/run/utmp

To do the same with /var/log/wtmp:

utmpdump /var/log/wtmp

And with /var/log/btmp:

utmpdump /var/log/btmp

you can use the following command to list all login events of a particular user (example: USER12345 ) and send the output to a .csv file that can be viewed with a pager or a workbook application, such as LibreOffice's Calc or Microsoft Excel.

Let's display PID, username, IP address and timestamp only:

utmpdump /var/log/wtmp | grep -E "\[7].*USER12345" | awk -v OFS="," 'BEGIN {FS="] "}; {print $2,$4,$7,$8}' | sed -e 's/\[//g' -e 's/\]//g'

If somebody is changing files remotely without authorization, you have very serious security problems.

You should disconnect the machine from the Internet, back up only configuration and data files, go over them with a fine comb to make sure nothing is fishy, reinstall from scratch, make sure you aren't running any vulnerable programs (specially user-written ones!), change all passwords to secure ones, disallow e.g. password SSH connections. Read up on securing your distribution, how to set up detailed logging and analyze the logs regularly.

My condolences.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .