Track File Changes

[misn1day]

Is there any way to track when a file has been changed and by what user?

 

[AIXSPadmin]

You can use the find command and use the options:
-user
-mtime (modification time)

e.g.
find / -user root -mtime 2
finds all files 2 days old modified by root

 

[misn1day]

What if you dont know the name of the user? I know a file was modified either by someone with root access or a member of the group that the file belongs too. I would like to know which user it was. Obviously if it was root, I wouldn't know, but if it was a user logged in under their name I would like to know.

 

[AIXSPadmin]

You could do an ls -i and get the inode number of the file and then do:

fsdb /filesystem

you will then need to enter the subcommand of the inode you got for the file:

an example below:
(spcws1)/data/req72724#fsdb /data


File System: /data

File System Size: 2228224 (512 byte blocks)
Disk Map Size: 21 (4K blocks)
Inode Map Size: 21 (4K blocks)
Fragment Size: 4096 (bytes)
Allocation Group Size: 2048 (fragments)
Inodes per Allocation Group: 2048
Total Inodes: 278528
Total Fragments: 278528

53354i
i#: 53354 md: f---rw-r--r-- ln: 1 uid: 1106 gid: 0
szh: 0 szl: 18 (actual size: 18)
a0: 0xd074 a1: 0x00 a2: 0x00 a3: 0x00
a4: 0x00 a5: 0x00 a6: 0x00 a7: 0x00
at: Wed Jun 19 14:09:08 2002
mt: Wed Jun 19 14:08:42 2002
ct: Wed Jun 19 14:08:42 2002

You will notice the uid:1106 and gid: 0 - these are who created the file and the at: mt: ct: are the respective access, modifiy, change times. But, unfortunately I don't know how you would find who changed it. fsdb is the filesystem debug utility, and this is the inode date, but it does not keep who changed it.

 

[misn1day]

Thanks for the help. I will give it a try

 

[MoshiachNow]

Hi,

fsdb will not work on a mounted system,one needs to unmount. "Long live king Moshiach !"
h

http://www.noahide.com/movement.htm