Possible Duplicate:
Access history of a file

I know if a file is "being accessed" I can use lsof to see who (which process) is accessing it, but lsof is slow and heavy and I don't think I would be able to run it fast enough to see if a file is accessed or not.

So it there a way to watch a file, and see if it ever get accessed and if yes by who?

marked as duplicate by Gilles, Caleb, Michael Mrozek Feb 23 '12 at 7:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Assuming you're running Linux:

You can use the audit subsystem to monitor access to a particular file.

You can use the inotify subsystem to watch for activities on files. There is a nice API for inotify, which makes it more useful for somethings than the audit subsystem, but inotify does not provide you with any information about who made the change that triggered a notification.

Not the answer you're looking for? Browse other questions tagged or ask your own question.