Ubuntu – How to find out which programs have modified a file over some period of time

filesloggingprocesstroubleshooting

I'd like to better understand which programs are modifying a specific file¹ during a reboot. Can I set something up to log this kind of information?

Polling for which processes currently have the file open won't work, as the file may only be open for a few milliseconds.

Can kernel tracing be used to collect this information?

¹ /var/lib/alsa/asound.state if you're curious, but I'm interested in a general solution.

Best Answer

This can be achieved with the fuser tool. It lists the process ID of all processes accessing a specific file. Try,

fuser -u .

...to see which files are "open" in your home directory, the process ID's involved and the username owning those processes.

In your case, I'm not sure this will be useful since you're trying to monitor a reboot. I suspect that rc.local will execute too late in the reboot to capture anything useful with, say,

watch -n 0.5 "fuser -u /var/lib/alsa/asound.state"

Hmm - I've just tried dumping this to a file and the output isn't very pretty. But if this can be resolved, then perhaps something can be achieved with cron?

Related Solutions

Ubuntu – How to find out, which jar-files java is currently running (and their PIDs)

You can run the lsof command, which lists which processes has open files, with your jar file given as an argument. An example viewing a file with less:

egil@mutter:~$ lsof foo.c
COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
less    18871 egil    4r   REG    8,2        0 53862540 foo.c
egil@mutter:~$

To easily reuse the pid in a script, you could run it in terse mode:

egil@mutter:~$ lsof -t foo.c
18871

Ubuntu – How to find out which user deleted a directory

I didn't find a magic bullet answer to your question; part of that reason is detailed here: https://superuser.com/questions/178596/checking-user-command-history-in-unix

This simple command may help you track down what happened, searching for rm & mv commands in all shell history files in all users home directories:

find /home -type f -iname .*history -exec grep "rm\|mv" {} \;

It's good you have a valid backup to save you, but I highly recommend creating some groups for project folders and just adding user accounts to those groups; that will save you a lot of pain in the future.

Example: add a group and add project team members to it

groupadd coolproject
adduser jim coolproject
adduser joe coolproject
adduser charlie coolproject

set the permissions properly recursively and guarantee access going forward for the team regardless of who creates/edits files

chown -R yourusername:coolproject /path/to/projectdir
find /path/to/projectdir -type d -exec chmod 2775 {} \;

(the 2 sets the group ownership to "sticky" this makes sure the group owner of any projects remains "coolproject")

find /path/to/projectdir -type f -exec chmod 664 {} \;

Hope that helps ya out! B-)

Best Answer

Related Solutions

Ubuntu – How to find out, which jar-files java is currently running (and their PIDs)

Ubuntu – How to find out which user deleted a directory

Related Question