4

Is there a command to give me the last user that accessed a specific folder in Ubuntu?

It is like auditing the folder for security reasons .

1 Answer 1

4

You can use auditd. To install it, run the following command from terminal:

sudo apt-get install auditd

How do I set a watch on a folder for auditing?

sudo auditctl -w /path/to/folder -p rwx -k password-file

The above command monitoring /path/to/folder for anyone that may perform a write, read or execute operation on that folder.

How do I find out who changed or accessed a folder?

Use ausearch command as follows:

sudo ausearch -f /path/to/folder -i | less

More about: Linux audit files to see who made changes to a file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .