Skip to main content

Suggested edits

Approve, reject, or improve edits suggested by users.

about the Suggested edits queue.

Review tasks Stats
Your daily reviews 0 /40
Review the following answer edit
4 answers
Score of 11
151594 views
History of users modifying a file in Linux
user2809888
Asked 9 years ago
11

Edit summary: Don't interrupt phrases like this. It is annoying to read.

One hack that can be used is (This will only work for the recent modification) you can check the last modified time for the file, and cross check with the log-in times of the users. You might be able to narrow the list down.

This will only work for the recent modification.

  1. use stat command (ex: stat <file_name>, See this)
  2. Find the Modify time
  3. Use last command to see the log in history (see this)
  4. Compare the log-in/log-out times with the file's Modify timestamp

This will not work all the time, but you can narrow the results down.

One hack that can be used is (This will only work for the recent modification) you can check the last modified time for the file, and cross check with the log-in times of the users. You might be able to narrow the list down.

  1. use stat command (ex: stat <file_name>, See this)
  2. Find the Modify time
  3. Use last command to see the log in history (see this)
  4. Compare the log-in/log-out times with the file's Modify timestamp

This will not work all the time, but you can narrow the results down.

One hack that can be used is you can check the last modified time for the file, and cross check with the log-in times of the users. You might be able to narrow the list down.

This will only work for the recent modification.

  1. use stat command (ex: stat <file_name>, See this)
  2. Find the Modify time
  3. Use last command to see the log in history (see this)
  4. Compare the log-in/log-out times with the file's Modify timestamp

This will not work all the time, but you can narrow the results down.

One hack that can be used is (This will only work for the recent modification) you can check the last modified time for the file, and cross check with the log-in times of the users. You might be able to narrow the list down.
One hack that can be used is you can check the last modified time for the file, and cross check with the log-in times of the users. You might be able to narrow the list down. This will only work for the recent modification.
1. use `stat` command (ex: stat <file_name>, [See this][1])1. use `stat` command (ex: stat <file_name>, [See this][1])
8 identical lines skipped
Proposed 2 days ago by an anonymous user
    11

    I am wondering if its possible to list who all modified the file with course of time. I am aware that stat or ls -lrt will give the last user who modified the file. But I want to find out if it is possible to find the N-1 user who modified the file.

    Note: I think chances are very slim to find such user. Just want to confirm with experts before declaring its a dead end.

    Example:

    At 1:00 AM ABC modified the file
    At 2:00 AM XYZ modified the same file.

    I am aware that XYZ has modified the file, How to find who modified the file before XYZ (In this case ABC)?

    CC BY-SA 3.0
    3
    • 2
      stat or ls don't list who modified the file, they list who owns the file. Without a version control system you won't get the information you want.
      – Christoffer Hammarström
      Commented Sep 2, 2015 at 9:15
    • 2
      I don't think it's possible. This is what SCM systems such as Git are for.
      – Arkadiusz Drabczyk
      Commented Sep 2, 2015 at 9:15
    • Thanks I wanted to check , got my answer. Thanks for clarifying.....
      – user2809888
      Commented Sep 2, 2015 at 9:18
    8

    I am aware that stat or ls -lrt will give the last user who modified the file.

    No. Modifying a file does not change its owner.

    In general filesystems do not keep track of modification histories. If this information is crucial, the way to go is

    1. For complete file hierarchies: a VCS (Version Control System) like Git, Subversion, Mercurial, CVS, ...
    2. For single files, RCS or SCCS, ...
    0
      7

      It is possible to configure auditing to track changes to specific files. There are some limitations:

      • it has to be configured before the changes of interest
      • the auditing daemon tends to refuse to start if told to watch a file which has been deleted.

      Still, it can be useful. Look for auditctl. Here are some useful links discussing the topic:

        0

        It is not possible to track user details like username who modify the file by a particular command. Only we can check the assigned username to file by ls -l.