In Linux how to find if a file was read and at what time

Question

Is there a tool or command where we can see if a file was read and at what time? I would only find for last modified.

Answer 1

stat and ls -lu can be used to find the last access time which includes the last time that it was read or otherwise accessed including by a tool like cat, awk, sed, grep, vim, less, tail, head, etc.

If by read, you mean something specific like using cat or a text editor like vim to actually view the entirety of its contents in stdout, then there is no way to tell whether or not that was done other than by setting up auditd and going through the audit logs and if you don't have that, going through the shell history of everything that has ever accessed it assuming that it even exists which clearly isn't viable. The only that can be determined for sure is access time. If you are considering any time that a file was read at all regardless of the quantity and method, the either of the commands that I gave will do it.

[nasir-rocky@rocky-linux ~]$ stat test
  File: test
  Size: 12              Blocks: 8          IO Block: 4096   regular file
Device: fd02h/64770d    Inode: 145         Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/nasir-rocky)   Gid: ( 1000/nasir-rocky)
Context: unconfined_u:object_r:user_home_t:s0
Access: 2023-05-29 18:54:53.740411288 -0400
Modify: 2023-05-29 18:54:50.254416606 -0400
Change: 2023-05-29 18:54:50.254416606 -0400
Birth: 2023-02-09 17:38:42.636002933 -0500

Here is ls -u (I'm using ll -u as an alias but it does the same thing)

[nasir-rocky@rocky-linux ~]$ ll -u test
-rw-r--r--. 1 nasir-rocky nasir-rocky 12 Sep 19 07:33 test

Notice how it is different from just ll or ls -l which shows the modify time

[nasir-rocky@rocky-linux ~]$ ll test
-rw-r--r--. 1 nasir-rocky nasir-rocky 12 May 29 18:54 test

Answer 2

Most Linux filesystems update and store more than a modification time attribute but also record an file access time (atime).

Note: how exact that atime timestamp is, or if it will be available/updated at all, that depends on filesystem used and mount options like noatime , strictatime and relatime etc.)

There are many ways to display the atime attribute, with the ls flags -u and or --time=atime or for example the stat command.

stat .bashrc

  File: ‘.bashrc’
  Size: 231         Blocks: 8          IO Block: 4096   regular file
Device: fd01h/64769d    Inode: 262277      Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/  hbruijn)   Gid: ( 1000/  hbruijn)
Context: system_u:object_r:user_home_t:s0
Access: 2023-09-01 12:59:34.648395490 +0200
Modify: 2016-12-07 00:19:33.000000000 +0100
Change: 2017-09-25 14:15:35.152000000 +0200
 Birth: -

---

To find out WHO accessed a file, that typically requires setting up auditing (in advance), with auditd, as does getting a comprehensive record of every time a file is accessed.

Answer 3

how to find if a file was read, and at what time

auditd

set up a watch rule in /etc/audit/rules.d/audit.rules on that specific file, such as

-w  /opt/something/somefile    -p r    -k ABC123

• the -k is a key name that will show up in /var/log/audit/audit.log, so use something unique that you can text search on easily in audit.log
• the -p is the permission flag, with r being for read; all the options here that could be used are rwxa for read, write, execute, change of attributes
  • https://man7.org/linux/man-pages/man7/audit.rules.7.html

there's probably other ways to do an audit rule to accomplish what you asked, but based on what you specifically asked of only if it was read, then just the r flag on a watch type of audit rule seems like the best way to do it.

In audit.log that line entry having that unique key name (ABC123 per my example) will indicate every time that file was read/written/executed/attributes_changed. And will also contain by who, process id, a whole bunch of sh..info.

Only downside is the timestamp in audit.log is in epoch format {seconds since 1/1/1970} so you'll have to convert it to human format.