> I think if you enable auditing in the kernel and emerge > sys-process/audit you can see the access history of any file on your > system. (doesn't help after the fact, but going forward...) At least > then you could see which user/program did things to which files. I > think even if a file is missing that you think should have been there > you can do an audit search and see who deleted it. I've never tried it > myself but that's how I understand it. I could be wrong.
That could be really handy if you could find out when was the last time a file was accessed. If you weren't sure that a file is cruft or not, you could examine that last access date. > And it's not what you asked for, but for cleaning cruft out of > distfiles i use eclean from app-portage/gentoolkit... works great. > Whenever I'm running low on space I run it and it zaps a few gigs of > unneeded stuff without deleting the distfiles of active packages. Yeah, eclean is great. - Grant
