Is there a log which records the creation of directories?

Question

I'm trying to track down why and when a particular directory is created in my home folder.

I've learned I can utilize lsof | grep /home/**myusername**/**mysteriousfolder** to discover the file or process responsible for creating the folder.

Unfortunately, if the responsible process/file is no longer running, the suggested command gives no output. As of yet, I have been unable to catch it 'in the act.'

I'm looking for a log I can parse to discover when exactly this folder is getting created.

So I'm realizing I can at least do ls -ld and view the 'last modified' date but I'm still curious if any log file exists.

Can you share the name of the mysterious folder? People here may recognize it, saving you time. — ImaginaryRobots, Aug 20 '12 at 17:27
Related: How can I find out which processes have modified a file over some period of time? — ændrük, Aug 20 '12 at 18:08
@ImaginaryRobots I asked about the specifically titled directory in this question. — Insperatus, Aug 21 '12 at 04:19

score 2 · Accepted Answer · edited Apr 13 '17 at 12:24

There is no general log for the home folder that details when files and folders were created; the system logs record a number of things, including when software is installed, and often a hidden folder is created in the home folder when you add software, so you might be able to infer when that was created and where it came from by looking at the system logs.

On your system, files and folders are not marked with the time they were created; as you can see below with the stat command only the access (atime), modify (mtime) and inode change times (ctime) are listed.

Full output from stat ~/Downloads:

  File: `/home/mike/Downloads'
  Size: 53248       Blocks: 104        IO Block: 4096   directory
Device: 801h/2049d  Inode: 6291653     Links: 38
Access: (0755/drwxr-xr-x)  Uid: ( 1000/    mike)   Gid: ( 1000/    mike)
Access: 2012-08-20 11:54:35.024905317 +0100
Modify: 2012-08-20 11:54:33.980904809 +0100
Change: 2012-08-20 11:54:33.980904809 +0100
 Birth: -

You can use fuser to see what processes are accessing which folders; for example, to view those processes related to your overall home folder, enter:

fuser -v /home/mike

If you are concerned that something unauthorised is accessing your home folder I should take a look at the suggestions I made here in this article about searching for files having been modified by a person who is not your user.

Some programs create logs and these might log their activities, but they can be difficult to search as a whole without going through your entire home folder. If you want to monitor yourself you could install some software that logs and monitors everything you do.

If you want to monitor and record to file everything typed into your interactive bash terminal (including mkdir commands), you could put this clever use of the trap command into your .bashrc.

Thanks for your thorough response. I plan to use either incron or inoticoming to watch for the creation of the directory and call either fuser or lsof to identify the creating process/file. I'm sure its just some software I installed creating the directory and not a rogue user :) Your information is valuable none the less, thanks! — Insperatus, Aug 22 '12 at 23:38

Is there a log which records the creation of directories?

1 Answers1