Who last modified file?

Question

Is there a way to tell who (which user) last modified the last file in Linux (RHEL)?

https://unix.stackexchange.com/questions/42234/display-a-files-history-list-of-users-that-have-modified-a-file is more recent and has some answers — carl verbiest, Sep 02 '19 at 13:52

score 20 · Accepted Answer · answered Dec 29 '09 at 01:50

This is far from reliable, but if we are talking about shell access, you could cross-reference the file's modification time with the users logged in at that time (last) and then check their ~/.bash_history (or equivalent) for editing commands. Even grep -H filename /home/*/.bash_history could give you a starting point.

score 18 · Answer 2 · answered Dec 28 '09 at 22:50

18

No, there is no reliable way to discover that.

The stat command shows you everything that's known about a file (except the actual contents). You can add the -Z option to get some SELinux info; but none of that tells you who modified the file last.

answered Dec 28 '09 at 22:50

freiheit

14,624

1

Yeah but no other tools to dig out ? – Raja G Mar 12 '15 at 06:28

Who last modified file?

2 Answers2