Hi all, I would like to know if is there any way to audit the last modification of a file in ext3. I know when was it thanks to stat, but, how could I know who was it?
Thank you.
Printable View
Hi all, I would like to know if is there any way to audit the last modification of a file in ext3. I know when was it thanks to stat, but, how could I know who was it?
Thank you.
Only if SELinux was turned on. A regular linux lacks the audit trail.
Hi Derek, it has been some time since I have dealt with this sort of thing, so please forgive me if I am missing the point.
As I recall, ext3 is a journalling file system, and would have an underlying ext2 ?
As such, I would expect the ext3 to contain "transactions" and that these would naturally have a timestamp, as one of the purposes of journalling is to facilitate rapid recovery if the main file gets screwed. You would need to select date/time parameters for this?
I do not think that you will be able to find the user unless this information is deliberately collected by your file maintenance system.
As the experience I have had has always been with financial systems, this was always the case and you would simply use a query utility or transaction look-up application.
You need to look at your file layouts and see if they contain something like "record created by" and "record amended by".
Hope that helps :)
EDIT: Good point there SirDice, I had forgotten about Security Enhanced Linux. Come to think of it, the system I worked on was Unix rather than Linux and I have no idea what the file system was. It did have journalling though. I would guess that the only defaults were a unique record key and a timestamp.
So, I would still approach it the same way: Are there fields to store the user data? and are they getting populated?