Unix Internal Question

UNIX for Advanced & Expert Users
1

Hi Guys-

Does anyone know how to determine the unix user id that accessed a particular file?

For instance, we have a particular file under /usr/var/sample.exe ; I'm executing "ls -ltu /usr/var/sample.exe" and finds out that it has been accessed recently. How could i find out the user id that accessed it? Or the user id that launched/owned a process that actually accessed the file?

Thanks in advance.

-Marlonus999

2

There is no historical way to see who ran what executable. Some types of add-on accounting software can track this kind of operation - execute access for a file.
What OS?

If sample.exe produces a known output file, look for a file by that name with find and check file ownership.

Your best shot is to implement some shell code with lsof or fuser that will monitor use of that file in the future. If this is a security problem, lock down access to that file/directory.

3

Great! I was able to monitor file openings of this file via "fuser -f /usr/var/sample.exe". Actually "fuser -fu" does the trick also, but I wanted to know the exact process accessing the file, so I cooked up a short script below. BTW, the OS is HP 11.11

Code snippet:

- - -
#!/bin/ksh

while [ true ]
do
line=`fuser -f /usr/var/sample.exe 2>/dev/null`
if [[ -n $line ]]
then
echo
prc=`echo $line | sed 's/o//g'`

for i in \`echo $prc\`
do
	ps -efxx |grep $i |grep -v "grep"
done

fi
sleep 1
done

- - -

Thanks Jim M. !