Welcome to the most active Linux Forum on the web.
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


  Search this Thread
Old 10-28-2013, 10:26 PM   #1
LQ Newbie
Registered: Oct 2013
Posts: 2

Rep: Reputation: Disabled
List all machine mac addresses which modified my file or folder on server

Hi all,

If I have a file in a Linux server, I can find the last access or modify time of the file, but how can I find more complex modification information in a specified time such as:

Mac address (I need the most)
And relative modification time

Thanks for the help!
Old 10-28-2013, 11:16 PM   #2
Ser Olmy
Senior Member
Registered: Jan 2012
Distribution: Slackware
Posts: 2,469

Rep: Reputation: Disabled
The name of a user modifying a file is not stored in the file system, only the user ID of the user that created the file.

To log the UID of users accessing a file, you'll need to audit file system operations. You may want to install the "audit" package for your distribution and check out the man pages for auditd, auditctl and ausearch.

As for the IP or MAC address of the user's workstation, that's not something you'll find in the audit log because that information exists way down in the network stack:
The file is being accessed by a
user who has opened a
session from a
host with a specific
IP address bound to an
Ethernet MAC address.
You didn't mention how the files are being accessed over the network. The IP address of the host from where the user is opening a session may be logged by whatever server process is serving the file (NFS, samba, a web server or something else entirely).

The IP/MAC binding only exists in the ARP cache of the server while the session is active, and that is assuming the server and client is on the same network. I guess you could log this information with an iptables rule, but that log could get huge quickly if you have lots of users accessing lots of files. The performance impact would probably be significant as well.

If the client is on a different network/subnet, the server will only see the MAC address of the next-hop router.
Old 10-28-2013, 11:32 PM   #3
LQ Newbie
Registered: Oct 2013
Posts: 2

Original Poster
Rep: Reputation: Disabled
Thanks very much for your reply! In my case, mostly server and client are on the same network.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
getting last X files, by modified date to build Rsync file list nadigo Programming 1 04-26-2012 05:26 AM
DHCP3-Server giving IP addresses depending on MAC Nutnot Linux - Server 4 04-11-2011 09:29 PM
Binding 2 NICs (MAC addresses) to 2 IP Addresses in same Subnet RedHat EL4.0 skhira Linux - Networking 13 02-24-2008 09:16 PM
Binding 2 NICs (MAC addresses) to 2 IP Addresses in same Subnet RedHat EL4.0 skhira Linux - Networking 1 02-09-2008 08:17 AM > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 03:59 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration