Audit file access on ext3 systems

[nihil]

Hi Derek, it has been some time since I have dealt with this sort of thing, so please forgive me if I am missing the point.

As I recall, ext3 is a journalling file system, and would have an underlying ext2 ?

As such, I would expect the ext3 to contain "transactions" and that these would naturally have a timestamp, as one of the purposes of journalling is to facilitate rapid recovery if the main file gets screwed. You would need to select date/time parameters for this?

I do not think that you will be able to find the user unless this information is deliberately collected by your file maintenance system.

As the experience I have had has always been with financial systems, this was always the case and you would simply use a query utility or transaction look-up application.

You need to look at your file layouts and see if they contain something like "record created by" and "record amended by".

Hope that helps

EDIT: Good point there SirDice, I had forgotten about Security Enhanced Linux. Come to think of it, the system I worked on was Unix rather than Linux and I have no idea what the file system was. It did have journalling though. I would guess that the only defaults were a unique record key and a timestamp.

So, I would still approach it the same way: Are there fields to store the user data? and are they getting populated?