Avatar of expertblr
expertblr asked on

How to know when and who (program) accessed a particulra file

Hi Experts,

     Is there any commands or utilites to know when and who accessed a particular file ...

Say For Ex :  /var/opt/.oracle

I would like to know when this file was accessed and who accessed this file .... I know we can do this by OS auditing... but I would like to know is there any command to do this except  OS auditing??

OS SecurityLinux NetworkingLinux Security

Avatar of undefined
Last Comment

8/22/2022 - Mon

you need to see accounting

Haven't been in linux for awhile but the basic concept of finding out what "has happened", "when it happened" and and "who did  it" implies logging of some sort. That is storage of "what", "when", and "who"
for there to be a command to view the information there would be a log file of some sort that stores the info.  Seems that you know that auditing is possible. Audit = logging

Not much of a solution but it's an understanding.


I'm looking for a definitve answer --- Is it possible without OS auditing ? Yes or NO ?
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Log in to continue reading
Log In
Sign up - Free for 7 days
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.


sharing the  points...