History of users modifying a file in Linux

Question

I am wondering if its possible to list who all modified the file with course of time. I am aware that stat or ls -lrt will give the last user who modified the file. But I want to find out if it is possible to find the N-1 user who modified the file.

Note: I think chances are very slim to find such user. Just want to confirm with experts before declaring its a dead end.

Example:

At 1:00 AM ABC modified the file
At 2:00 AM XYZ modified the same file.

I am aware that XYZ has modified the file, How to find who modified the file before XYZ (In this case ABC)?

Character

stat or ls don't list who modified the file, they list who owns the file. Without a version control system you won't get the information you want. – Symbolics

I don't think it's possible. This is what SCM systems such as Git are for. – Epigrammatist

Thanks I wanted to check , got my answer. Thanks for clarifying..... – Character

Answer 1

I am aware that stat or ls -lrt will give the last user who modified the file.

No. Modifying a file does not change its owner.

In general filesystems do not keep track of modification histories. If this information is crucial, the way to go is

1. For complete file hierarchies: a VCS (Version Control System) like Git, Subversion, Mercurial, CVS, ...
2. For single files, RCS or SCCS, ...

Ftlb

Answer 2

One hack that can be used is (This will only work for the recent modification) you can check the last modified time for the file, and cross check with the log-in times of the users. You might be able to narrow the list down.

1. use stat command (ex: stat , See this)
2. Find the Modify time
3. Use last command to see the log in history (see this)
4. Compare the log-in/log-out times with the file's Modify timestamp

This will not work all the time, but you can narrow the results down.

Shopping

Answer 3

It is possible to configure auditing to track changes to specific files. There are some limitations:

• it has to be configured before the changes of interest
• the auditing daemon tends to refuse to start if told to watch a file which has been deleted.

Still, it can be useful. Look for auditctl. Here are some useful links discussing the topic:

• Linux audit files to see who made changes to a file
• Monitoring Linux File access, Changes and Data Modifications
• Track file changes using auditd
• The Linux Audit System, or Who Changed That File?

Lagniappe

Answer 4

It is not possible to track user details like username who modify the file by a particular command. Only we can check the assigned username to file by ls -l.

Armallas