0

I am going through my Recent folder on ubuntu and I see there are files which I did not directly access myself. If I right click on a file it will say Accessed: with a certain time and date there.

Is there anyway I can tell what program or process accessed that file?

I am running Ubuntu 16.04 and using GNOME.

Jon
  • 101

1 Answers1

1

Is there anyway I can tell what program or process accessed that file?

No -- not in default implementation as there is no process (or kernel for that matter) tracking that in general (there could be specific cases for some programs, which are program specific obviously), and dumping log or keeping in memory.

But there are ways, if you want to do that. The best IMO would be to use the inotify family of system calls to track the filesystem accesses. You are basically looking for the inotifywait userspace command (comes with inotify-tools package) to set a watch on the accesses of desired file(s), and do any operation like logging if you want.

Here is an old answer of mine to get you started.

Further hint: you're looking for the access event.

heemayl
  • 91,753