Hello, I am new to Linux. I was just assigned to the Unix team at my work and am trying to keep my head above water.
I was tasked to attempt to find a solution to the following issue.
We need to find out which files on a mount point are being accessed the most by users (RHEL 6.9) and how many times these files are being accessed in a given period (week, month, ect.) They want it all wrapped up in a nice and neat report.
I looked at the FIND command, the auditctl utility and am a bit confused.
Does anyone have any thoughts on how to efficiently pull this data together?

Thank you!!!

I'd probably use https://linux.die.net/man/1/inotifywait to generate the results, and then post process the results, probably in Perl but bash/sed/awk would work also.
You could even go just Perl with http://search.cpan.org/~mlehmann/Lin...22/Inotify2.pm to get results.

HTH & Welcome to LQ

No, inotify takes some kernel resource to monitor a certain file. If this is a directory, it will not monitor its existing contents.
Better is auditing/auditctl, if the number of files is high/unknown and the purpose is security or billing (you must not miss a single file-open!). Auditing can generate tons of log data!
If the purpose is usage/statistic then it's often sufficient to check the last access/atime of the files. This can be done with "find -atime". A recent access means it is likely the file is accessed frequently, without exact tracking.
On recent Linux atime is only updated once per day; if this is too unprecise then the file system must be mounted with strictatime option.

RHEL has intrinsic tools for this purpose as RHEL is designed for large servers.

Please read carefully: https://access.redhat.com/documentat..._auditing.html
and give it a try.

If you run into trouble, please paste the full command and any output error messages here using the CODE construct.

Thank you for the replies chrism01, madeingermany and aragorn2101! I will read over your suggestions and give them a try!

Debian has some sort of FAM aka file alteration manager. Although I've never really used it, just noticed it running a few times. I don't know if RHEL has an equivalent, never used it.