How to tell what process last wrote to a file?

kcoriginal · 12-28-2008, 09:33 PM

I am trying to get a multi website running behind a dynamic ip with a ddns service.. lots of questions... just asking one at the moment.

What is writing to my server's hosts file to tell it my public (though dynamic, technically... it hasnt changed in a year now...) ip address as if it is one of the server's alternate IPs... I do have the server set as DMZ on my WRT54G. but... either way... I know somehting in the actual Linux (CentOS 5.2) OS is updating the hosts file with the outside IP. How can I track what process last accessed a file?

If you know the answer to my current specific problem, then ... GREAT!
please tell! But... I am looking to learn the troubleshooting technique for future problems..

thx in advance!

kc

dquick1 · 12-28-2008, 11:53 PM

Hi KC,

Unless the process you are trying to debug generates a log file or similar, I don't know anyway to find out this information.

Files in linux are identified and managed using 'Inodes'. Inodes are data structures that pretty much everything about a file except the actual data. This includes permissions, and timestamps etc. Unfortunately they do not store details of the process or user of the last file access etc. For information on Inodes go here: http://www.linfo.org/inode.html

The closest command that I am aware of is stat.

Code:

$ stat test
  File: `test'
  Size: 75              Blocks: 16         IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 3008992     Links: 1
Access: (0664/-rw-rw-r--)  Uid: (  500/     dlq)   Gid: (  500/     dlq)
Access: 2008-12-29 16:09:53.000000000 +1100
Modify: 2008-12-29 16:09:28.000000000 +1100
Change: 2008-12-29 16:09:28.000000000 +1100

Damien