I have some questions about viewing who accessed a file.

I found there are ways to see if a file was accessed (not modified/changed) through audit subsystem and inotify.

However, from what I have read online, according to here: http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

it says to 'watch/monitor' file, I have to set a watch by using command like:

# auditctl -w /etc/passwd -p war -k password-file

So if I create a new file or directory, do I have to use audit/inotify command to 'set' watch first to 'watch' who accessed the new file?

Also is there a way to know if a directory is being 'watched' through audit subsystem or inotify? How/where can I check the log of a file?


from further googling, I found this page saying: http://www.kernel.org/doc/man-pages/online/pages/man7/inotify.7.html

The inotify API provides no information about the user or process that triggered the inotify event.

So I guess this means that I cant figure out which user accessed a file? Only audit subsystem can be used to figure out who accessed a file?

1 Answer 1


Logs from the audit subsystem are based on paths. You can put a watch on a file name even if that file doesn't exist. You'll get log entries if the file is created and accessed.

All logs from auditd are saved in one file (generally /var/log/audit/auditd.log).

You can list the audit rules with auditctl -l.

  • When you say that a file that doesn't even exist can be watched, I assume you mean if a file or directory is created in a directory that is being watched, the new files & directories are automatically watched too?
    – J L
    Apr 4, 2012 at 2:01
  • @JL Yes, the point is that the watch is associated to a path (or path fragment, if that path is or becomes a directory) and not to, say, an inode. Apr 4, 2012 at 7:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .