LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 10-28-2013, 10:26 PM   #1
dancingMaria
LQ Newbie
 
Registered: Oct 2013
Posts: 2

Rep: Reputation: Disabled
List all machine mac addresses which modified my file or folder on server


Hi all,

If I have a file in a Linux server, I can find the last access or modify time of the file, but how can I find more complex modification information in a specified time such as:

userID
Mac address (I need the most)
And relative modification time

Thanks for the help!
dancingMaria
 
Old 10-28-2013, 11:16 PM   #2
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 2,078

Rep: Reputation: Disabled
The name of a user modifying a file is not stored in the file system, only the user ID of the user that created the file.

To log the UID of users accessing a file, you'll need to audit file system operations. You may want to install the "audit" package for your distribution and check out the man pages for auditd, auditctl and ausearch.

As for the IP or MAC address of the user's workstation, that's not something you'll find in the audit log because that information exists way down in the network stack:
The file is being accessed by a
user who has opened a
session from a
host with a specific
IP address bound to an
Ethernet MAC address.
You didn't mention how the files are being accessed over the network. The IP address of the host from where the user is opening a session may be logged by whatever server process is serving the file (NFS, samba, a web server or something else entirely).

The IP/MAC binding only exists in the ARP cache of the server while the session is active, and that is assuming the server and client is on the same network. I guess you could log this information with an iptables rule, but that log could get huge quickly if you have lots of users accessing lots of files. The performance impact would probably be significant as well.

If the client is on a different network/subnet, the server will only see the MAC address of the next-hop router.
 
Old 10-28-2013, 11:32 PM   #3
dancingMaria
LQ Newbie
 
Registered: Oct 2013
Posts: 2

Original Poster
Rep: Reputation: Disabled
Thanks very much for your reply! In my case, mostly server and client are on the same network.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
getting last X files, by modified date to build Rsync file list nadigo Programming 1 04-26-2012 05:26 AM
DHCP3-Server giving IP addresses depending on MAC Nutnot Linux - Server 4 04-11-2011 09:29 PM
Binding 2 NICs (MAC addresses) to 2 IP Addresses in same Subnet RedHat EL4.0 skhira Linux - Networking 13 02-24-2008 09:16 PM
Binding 2 NICs (MAC addresses) to 2 IP Addresses in same Subnet RedHat EL4.0 skhira Linux - Networking 1 02-09-2008 08:17 AM


All times are GMT -5. The time now is 06:40 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration