Suppose i am a user of linux box : A
I also have an access to application account in the box and I sudo it : B
Somebody else who is a user C also sudo to: B

Question: When the user C copies or modifies any file say test.txt in a folder say /home/application/ , I need to know who has done it means the original id (C).

When I execute ls -ltr it shows that the file is created and modified by application account "B". I wanted to know the real user , in this case it wold be "C"

Is there any possibility to know it?

  • 1
    You will have to look at the logs. – muru Jan 10 '18 at 10:41


command shows necessary details

Or you can write this command.

grep -H filename /home/*/.bash_history

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.