File Accessed Alarm ??

Hey,

I want to ask a simple Question....

How would I be able to come to know that files/directoires in a Parent directory has been accessed (means contents of the file has been just viewed) by the user(s) in a group ? and mail the name(s) of those files/directories which has been accessed recently in past 1 or 2 minutes with the name of the user who viewed the files/direcotries.

How will I write script for this ??

Please answer this QUESTION asap as I am after this problem for past 15 days and I did't get any perfect answer.

Please Help !!
Thanks !!

Hey Varun,
Hope you guys are doing Gr8 !!
Once again I dun have any *NIX box with me. So why Just giving one logic by which you will get your answer.
-------------------------------------------------------------
#!/bin/bash

## List all the files which one accessed since last 1 min #####
for file_dir in `find <parent-dir> -atime -1`

do
### Find out the PID for that files which one been accessed
pid=`fuser -f $file_dir`

### Find out the owner/user name for that Process
### Replace the $access_user_filed with the filed no from the ps -ef
### command
user=`ps -ef | grep $pid | awk { print $access_user_filed }`
echo " $file_dir access by the $user " >> File_Access_List "
mail -s " File Access List " user@yourdomain.com < File_Access_List
done

Hey,

Thanks buddy...I'll come back to you with the results of your post.
It looks fine !!

Hey,
please clarify my doubt..
What is $access_user_filed , used in the following command ?user=`ps -ef | grep $pid | awk { print $access_user_filed }`

In ps -ef we have following columns..
UID PID PPID C STIME TTY TIME CMD
Are you talking about UID or anything else ??

Sorry It is my typo.

$access_user_filed is actuly the UID(user id ) Filed no from the out put of ps -ef command

Thanks~

NO probs, I got that !!
Thnks !!

Hey ,

When I run the script it gives me following error :

AccessLogMonitor_script[11]: 0403-057 Syntax error at line 23 : `"' is not matched.
And my script is, as per your suggestions :
---------------------------------------------------------------------
#SCRIPT TO CHECK WHO HAS ACCESSED THE LOG/FILE IN PAST 'N' MINUTES, AND MAIL ACCORDINGLY.

MYPATH="/clocal/mqbrkrs/user/mqsiadm/sanjay/"
MAIL_RECIPIENTS="abc@xyz.com"
Subject="File accessed in last few minutes are ::"
>tempmail.txt
>tempfind.txt

## List all the files which one accessed since last 1 min #####

for file_dir in `find $MYPATH -amin -1`
do
### Find out the PID for that files which one been accessed
pid = `fuser -f $file_dir`

### Find out the owner/user name for that Process
### Replace the $access_user_filed with the filed no from the ps -ef
### command
user = `ps -ef | grep $pid | awk { print $1 }`
echo " $file_dir access by the $user " >> tempmail.txt "
done

cat tempmail.txt | mailx -s "$Subject" "$MAIL_RECIPIENTS"
---------------------------------------------------------------------

Suggest me !!
Thanks !!

if you are on linux, you can turn on auditing using auditd. commands like auditctl, ausearch,aureport may be able to help you. if you are on solaris, you can turn on BSM.

Hey,

I am using AIX5.2.
Do you have any idea, that I could use commands given by you, in AIX5.2.

I dont. find the manuals for the commands given by use, i think i can't use those commands.

I am not on AIX, but a search produce this. you might want to take a look. Some ppl here are on AIX(aigles?) , so hope they can provide you some insights...

Any help, I would appriciate !!

### Find out the owner/user name for that Process
### Replace the $access_user_filed with the filed no from the ps -ef
### command
user = `ps -ef | grep $pid | awk '{ print $1 }'` (I think you need the single quotes here?)
echo " $file_dir access by the $user " >> tempmail.txt " (here you have 3 " characters)
done

fuser only tells you which process is using a file at that moment. It tells you nothing about access between invocations of fuser.

I have removed last double quote that was used in echo command. Thats fine.

Now when I add single quotes in awk, as you mentioned, then it gives error on grep command.

AccessLogMonitor_script[14]: pid: not found.
Usage: grep [-r] [-R] [-H] [-L] [-E|-F] [-c|-l|-q] [-insvxbhwy] [-p[parasep]] -e pattern_list...
[-f pattern_file...] [file...]
Usage: grep [-r] [-R] [-H] [-L] [-E|-F] [-c|-l|-q] [-insvxbhwy] [-p[parasep]] [-e pattern_list...]
-f pattern_file... [file...]
Usage: grep [-r] [-R] [-H] [-L] [-E|-F] [-c|-l|-q] [-insvxbhwy] [-p[parasep]] pattern_list [file...]
AccessLogMonitor_script[19]: user: not found.

How to solve this ?? Please help !!

#SCRIPT TO CHECK WHO HAS ACCESSED THE LOG/FILE IN PAST 'N' MINUTES, AND MAIL ACCORDINGLY.

MYPATH="/clocal/mqbrkrs/user/sanjay/"
MAIL_RECIPIENTS="abc@def.com"
Subject="File accessed in last few minutes are ::"
>tempmail.txt
>tempfind.txt

## List all the files which one accessed since last 1 min #####

for file_dir in `find $MYPATH -amin -1`
do
### Find out the PID for that files which one been accessed
pids = ''
#fuser -f "$file_dir" > tempfind.txt
#pid=$(tr -dc "[:digit:]\n" < tempfind.txt)
pids=`fuser -f "$file_dir" | tr -dc "[:digit:]"`
echo "$pids"

### Find out the owner/user name for that Process
### Replace the $access_user_filed with the filed no from the ps -ef
### command
user = `ps -ef | grep -w "$pid" | awk '{ print $1 }'`
echo " $file_dir access by the $user " >> tempmail.txt
done

cat tempmail.txt | mailx -s "$Subject" "$MAIL_RECIPIENTS"

Prblem is, I am not getting o/p in tempmail.txt file.
Please guide me on this !!

Thanks in advance !!

i tried the above all scripts, the users who has accessed the files is not displaying in the mail which i recieve,

thanks

All the scripts are using fuser, which will send you an alert only if the script runs when the user is accessing the file. As porter has already mentioned, it will give no details for access in the interval between script invocations. Suggest checking out the link that ghostdog74 has posted.