How to find out who wrote a file?

thomas2004ch · 08-05-2014, 02:54 AM

Hi,

I find quite often a file xa_NULLDDMMYYYY written under a directory. I wonder if I can find out who (which user) did this.

Any idea?

a4z · 08-05-2014, 04:00 AM

ls -l fielname
shows you the user and group name
not sure if that helps you
you can use lsof to find out who (which process) uses the file

thomas2004ch · 08-05-2014, 04:42 AM

I know command 'ls -l'. It's a basic command.

What I want is: I wonder if there is a history-list where I can find out which process and who wrote/created a file under a directory such as /tmp.

Maybe not possible?

a4z · 08-05-2014, 05:27 AM

as written
lsof /file/name
shows you who is using a file
if the file does not exist it returns an error

fuser could also be an option,

chrism01 · 08-05-2014, 05:45 AM

Retrospectively, no ...
You need to setup a tool like dnotify, maybe psacct in advance.
http://www.tecmint.com/how-to-monito...or-acct-tools/
http://linux.die.net/man/1/dnotify

pan64 · 08-05-2014, 05:49 AM

Quote:

Originally Posted by thomas2004ch

I wonder if there is a history-list where I can find out which process and who wrote/created a file under a directory such as /tmp.

are you looking for this: http://linux.die.net/man/1/inotifywait or this: http://linux.die.net/man/8/auditd ?

syg00 · 08-05-2014, 05:55 AM

Nevermind ... asleep at the wheel ....