Deckweiss, 1 year ago (edited 1 year ago)

The better solution:

sudo apt-get install auditd

Set up watch: sudo auditctl -w /path/to/your/file -p wa -k file_change_monitor

Check log: sudo ausearch -k file_change_monitor

---

Alternative solution:

If you know the file that is being edited you can set up watches with inotifywait and log it to a file. This may possibly not work because lsof might not be quick enough.

sudo apt-get install inotify-tools

then put this script in autostart

<span style="color:#323232;">#!/bin/bash
</span><span style="color:#323232;">
</span><span style="color:#323232;">FILE_TO_MONITOR="/path/to/your/file"
</span><span style="color:#323232;">LOG_FILE="/path/to/logfile.txt"
</span><span style="color:#323232;">
</span><span style="color:#323232;">inotifywait -m -e modify,move,create,delete --format '%w %e %T' --timefmt '%Y-%m-%d %H:%M:%S' "$FILE_TO_MONITOR" |
</span><span style="color:#323232;">while read path action time; do
</span><span style="color:#323232;">    # Get the PID of the process that last modified the file
</span><span style="color:#323232;">    PID=$(lsof -t "$FILE_TO_MONITOR" 2>/dev/null)
</span><span style="color:#323232;">
</span><span style="color:#323232;">    # Get the process name using the PID
</span><span style="color:#323232;">    PROCESS_NAME=$(ps -p $PID -o comm= 2>/dev/null)
</span><span style="color:#323232;">
</span><span style="color:#323232;">    # Log details to the file
</span><span style="color:#323232;">    echo "$time: File $path was $action by PID $PID ($PROCESS_NAME)" >> "$LOG_FILE"
</span><span style="color:#323232;">done
</span>

Don’t forget to modify the values at the top of the script and make it executable.