I was wondering if there are any tools to keep track of the access history of a file. I know of stat, but as far as I understand, it only returns information about the last time the file was accessed.
Answers:
Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.
Method 1
Logging access times is already a fairly heavy requirement (by filesystem performance standards), because it requires a write operation for every read operation. Logging other things would be even costlier. The feature is not present in typical filesystems.
LoggedFS is a stackable filesystem that provides a view of a filesystem tree, and can perform fancier logging of all accesses through that view. To configure it, see LoggedFS configuration file syntax.
On Linux, you can use the audit subsystem to log a large number of things, including filesystem accesses. Make sure the auditd daemon is started, then configure what you want to log with auditctl. Each logged operation is recorded in /var/log/audit/audit.log (on typical distributions). To start watching a particular file:
auditctl -w /path/to/file
If you put a watch on a directory, the files in it and its subdirectories recursively are also watched.
Method 2
This information is not stored in the classic filesystems, like ext2/3/4, vfat etc etc. So if you need file history you either need to use a filesystem that has this or put the file in a revision system like svn or git.
All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0