On Mon, 1 Jul 2002 12:37:38 -0400, [EMAIL PROTECTED] (James Kipp) wrote: >anyone know of a way to determine the user who last accessed or modified a >file ?
As others have said, it is difficult to do. However, I will point you toward 2 prospective solutions. Both are available at http://freshmeat.net 1. Grsecurity is a kernel patch for 2.4 kernels. It has a system for logging everything, including all file accesses. This bogs down the system so much, with the logging, that it might not be worth it to use. 2. Bubblegum is a c program that monitors a file's access and logs it. Now it dosn't log the username but it does log the pid of the process. You may be able to trace back the owner of the process. Anyways, those are 2 ideas for you. -- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
