I am looking for a way to check when a specific folder and also a specific file were created. Is it possible?
My system uses the ext3 file system.
Thanks a lot!
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It only takes a minute to sign up.Sign up to join this community
Most Unix-like operating systems don't store the creation time of file or directories. You can get their modification time, last access time, and inode change time via the
But, there are some third party tools as we can see in other answers. And, FreeBSD seems to have that capability. See @Graham Perrin's comment here which goes to that answer.
Assuming that you are using ext4, you can see when a file was created. The ext4 file system stores this as
You can get this information with the debugfs command.
Here is a script that you can run with superuser privileges to print the crtime of a file. (Note that it requires ruby and has a bug in the first line:
The brute force 'old school' way for ext3 is the "Tripwire" method (I named it from the insidious Tripwire product): build a list of files, then do it again, run diff. The more often you build your list and diff it, more close in time you will know when directories were both created AND deleted.
The two ways to build such a list is use:
ls or to use
lsof. You only need to save the diffs. If you know the user or the specific parent directory is not too large, then you can run it every second or more often (since sleep takes decimals) in a loop.
You can use a third party tool to do the job : I think of OSSEC, which is able to monitor directory content and file modification.