Home » Questions » Computers [ Ask a new question ]

See history of who all opened a particular file

See history of who all opened a particular file

How can I know who opened a particular file recently but might not have kept it opened at the moment?

Asked by: Guest | Views: 248
Total answers/comments: 2
Guest [Entry]

"Well, if you mean in the past, you probably cannot, unless you have some kind of audtiting turned on.

Assuming you do not, you can look at the permissions of the file and the directories to see who has has access. You can grep everyone's .bash_history file for the file name.

And that is about it, as far as I know. If they still have it open, you could use lsof, for instance."
Guest [Entry]

"Auditd is your friend.

Auditd man page

Not installed by default on most Linux distros yet though."