LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 08-05-2014, 02:54 AM   #1
thomas2004ch
Member
 
Registered: Aug 2009
Posts: 539

Rep: Reputation: 33
How to find out who wrote a file?


Hi,

I find quite often a file xa_NULLDDMMYYYY written under a directory. I wonder if I can find out who (which user) did this.

Any idea?
 
Old 08-05-2014, 04:00 AM   #2
a4z
Senior Member
 
Registered: Feb 2009
Posts: 1,727

Rep: Reputation: 742Reputation: 742Reputation: 742Reputation: 742Reputation: 742Reputation: 742Reputation: 742
ls -l fielname
shows you the user and group name
not sure if that helps you
you can use lsof to find out who (which process) uses the file
 
Old 08-05-2014, 04:42 AM   #3
thomas2004ch
Member
 
Registered: Aug 2009
Posts: 539

Original Poster
Rep: Reputation: 33
I know command 'ls -l'. It's a basic command.

What I want is: I wonder if there is a history-list where I can find out which process and who wrote/created a file under a directory such as /tmp.

Maybe not possible?
 
Old 08-05-2014, 05:27 AM   #4
a4z
Senior Member
 
Registered: Feb 2009
Posts: 1,727

Rep: Reputation: 742Reputation: 742Reputation: 742Reputation: 742Reputation: 742Reputation: 742Reputation: 742
as written
lsof /file/name
shows you who is using a file
if the file does not exist it returns an error

fuser could also be an option,

Last edited by a4z; 08-05-2014 at 05:29 AM.
 
Old 08-05-2014, 05:45 AM   #5
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Rocky 9.2
Posts: 18,356

Rep: Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751
Retrospectively, no ...
You need to setup a tool like dnotify, maybe psacct in advance.
http://www.tecmint.com/how-to-monito...or-acct-tools/
http://linux.die.net/man/1/dnotify
 
Old 08-05-2014, 05:49 AM   #6
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,828

Rep: Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308Reputation: 7308
Quote:
Originally Posted by thomas2004ch View Post
I wonder if there is a history-list where I can find out which process and who wrote/created a file under a directory such as /tmp.
are you looking for this: http://linux.die.net/man/1/inotifywait or this: http://linux.die.net/man/8/auditd ?
 
Old 08-05-2014, 05:55 AM   #7
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,124

Rep: Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120
Nevermind ... asleep at the wheel ....
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Find out what program last time wrote on given file nima0102 Linux - Software 3 09-19-2010 08:30 AM
Wrote to partition while making image file w/ dd: Did I mess it up? vincebs Linux - General 3 06-24-2010 08:18 AM
[SOLVED] a kernel i wrote myself cannot find data smeezekitty Programming 60 10-02-2009 03:56 PM
How to tell what process last wrote to a file? - hosts file being updated by unk kcoriginal Linux - General 1 12-28-2008 11:53 PM
I wrote a software to read PDF file naihe2010 Linux - Software 1 10-14-2008 06:00 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 12:07 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration