I would like to find files accessed by specific user (even just read) within a folder tree. I thought the find command had this option, but it actually just searches for owner user. Is there any other command, or command combinations? The stat command offers access information, but doesn't display the user who made access.


This information is not stored by traditional filesystems. You have three main options:

  • See who is accessing it in real time using lsof/fuser or similar;
  • Set up auditing (take a look at auditd);
  • Use something like LoggedFS.
| improve this answer | |
  • how does auditd compare with inotify, referenced above by wollud1969? – atroon Dec 13 '12 at 15:02
  • @atroon - Well, inotify can't notify you of which user did an action, so it seems irrelevant. – Chris Down Dec 13 '12 at 21:58
  • Huh, so 'filesytem events' does not include users. Interesting. I read the descriptions thinking it might be useful without getting into the details of precisely which events and just presumed there would be something on who had touched the file last. Thanks. – atroon Dec 14 '12 at 13:55

As far as I know, the only way to perform this is by activating auditd in your system. this way, it will log the access to all files and you can grep the logs files.

Be careful as the logging will be "heavy".

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.