LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 09-03-2017, 09:26 AM   #1
mauserme
LQ Newbie
 
Registered: Sep 2017
Posts: 2

Rep: Reputation: Disabled
How to find what files are being accessed the most times.


Hello, I am new to Linux. I was just assigned to the Unix team at my work and am trying to keep my head above water.
I was tasked to attempt to find a solution to the following issue.
We need to find out which files on a mount point are being accessed the most by users (RHEL 6.9) and how many times these files are being accessed in a given period (week, month, ect.) They want it all wrapped up in a nice and neat report.
I looked at the FIND command, the auditctl utility and am a bit confused.
Does anyone have any thoughts on how to efficiently pull this data together?

Thank you!!!
 
Old 09-03-2017, 11:23 PM   #2
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,863

Rep: Reputation: 2598Reputation: 2598Reputation: 2598Reputation: 2598Reputation: 2598Reputation: 2598Reputation: 2598Reputation: 2598Reputation: 2598Reputation: 2598Reputation: 2598
I'd probably use https://linux.die.net/man/1/inotifywait to generate the results, and then post process the results, probably in Perl but bash/sed/awk would work also.
You could even go just Perl with http://search.cpan.org/~mlehmann/Lin...22/Inotify2.pm to get results.

HTH & Welcome to LQ
 
Old 09-04-2017, 02:47 AM   #3
MadeInGermany
Senior Member
 
Registered: Dec 2011
Location: Simplicity
Posts: 1,746

Rep: Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791Reputation: 791
No, inotify takes some kernel resource to monitor a certain file. If this is a directory, it will not monitor its existing contents.
Better is auditing/auditctl, if the number of files is high/unknown and the purpose is security or billing (you must not miss a single file-open!). Auditing can generate tons of log data!
If the purpose is usage/statistic then it's often sufficient to check the last access/atime of the files. This can be done with "find -atime". A recent access means it is likely the file is accessed frequently, without exact tracking.
On recent Linux atime is only updated once per day; if this is too unprecise then the file system must be mounted with strictatime option.

Last edited by MadeInGermany; 09-04-2017 at 02:59 AM.
 
Old 09-04-2017, 04:05 AM   #4
aragorn2101
Member
 
Registered: Dec 2012
Location: Mauritius
Distribution: Slackware
Posts: 553

Rep: Reputation: 277Reputation: 277Reputation: 277
Quote:
Originally Posted by mauserme View Post
We need to find out which files on a mount point are being accessed the most by users (RHEL 6.9) and how many times these files are being accessed in a given period (week, month, ect.) ...
RHEL has intrinsic tools for this purpose as RHEL is designed for large servers.

Please read carefully: https://access.redhat.com/documentat..._auditing.html
and give it a try.

If you run into trouble, please paste the full command and any output error messages here using the CODE construct.
 
Old 09-04-2017, 07:10 AM   #5
mauserme
LQ Newbie
 
Registered: Sep 2017
Posts: 2

Original Poster
Rep: Reputation: Disabled
Thank you for the replies chrism01, madeingermany and aragorn2101! I will read over your suggestions and give them a try!
 
Old 09-04-2017, 07:20 AM   #6
Shadow_7
Senior Member
 
Registered: Feb 2003
Distribution: debian
Posts: 4,137
Blog Entries: 1

Rep: Reputation: 873Reputation: 873Reputation: 873Reputation: 873Reputation: 873Reputation: 873Reputation: 873
Debian has some sort of FAM aka file alteration manager. Although I've never really used it, just noticed it running a few times. I don't know if RHEL has an equivalent, never used it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Number of times a particular file is accessed in the system since it was created rahil khera Linux - Newbie 5 03-03-2014 06:18 PM
Is there a way to see how many times a file has be accessed via the internet? jim.thornton Linux - Newbie 1 07-25-2011 03:47 PM
[SOLVED] Command to find all of the files which have been accessed within the last 30 days sunilup Linux - Newbie 1 05-16-2010 01:32 AM
Find all files created or modified between 2 times MicahCarrick Linux - Software 3 06-29-2006 04:22 PM
Tracking the accessed files EdwinNameless Linux - Software 5 07-16-2003 11:00 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 08:55 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration