Software Tracking

[gizzmo]

For Mandrake 9.1, is there a way to track the use of a file. On my network, I'm trying to audit when a user opens a specific file and then closes it. Any help would be apprecitated. Thanks

[aru]

You can use "/usr/sbin/lsof" and maybe "/sbin/fuser"

 

Here are some examples from lsof man page:

 

To list all open files, use:

~# lsof

 

To list all open files for login name ``abe'', or user ID 1234, or process 456, or process 123, or process 789, use:

~# lsof -p 456,123,789 -u 1234,abe

 

To find the process that has /u/abe/foo open, use:

~# lsof /u/abe/foo

 

To send a SIGHUP to the processes that have /u/abe/bar open, use:

~# kill -HUP `lsof -t /u/abe/bar`

 

To find any open file, including an open UNIX domain socket file, with the name /dev/log, use:

~# lsof /dev/log

 

There are more examples including nfs and network runs.

 

Read both programs' man pages for more info.

 

HTH

[gizzmo]

Thanks aru,

 

This will get me started.