Determing when a file is (no longer) being accessed

[Phil_2]

I know, I Know - fuser. Well, we have just removed root access from some of our more trusted users, and lo and behold, some of their scripts no longer run properly. They were using 'fuser' to check file access before archiving a log file.
My Question: What other method can be used to determine if a file is no longer being accessed? (Something besides 'fuser'...)

My Best to all,
Phil

[Jeff Schussele]

Hi Phil

lsof immediately comes to mind & outta the box it IS executable by others.

Rgds,
Jeff

[Kenneth Platz]

You can use the following:

find /tmp -atime +7 -print

That will find all files and directories in /tmp that were last accessed 7 or more days ago.

[Robert-Jan Goossens · Accepted solution]

Hi Phil,

lsof ?

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.70/

Regards,
Robert-Jan

[Helen French]

Use 'find' command with -atime or -mtime or -ctime or -newer options. Read man pages for more information about these:

# man find

Eg:

# find /var -type f -mtime -2 -exec ll {} \;

this will list all files which were modified with in the last 2 days.

[Pete Randall]

Phil,

I'm not sure whether lsof would require root privileges as well but you could try it:

11i/64bit:
http://the-other.wiretapped.net/security/host-security/lsof/binaries/hpux/B.11.00/vxfs/64/9000_785/

11.0/64bit:
http://the-other.wiretapped.net/security/host-security/lsof/binaries/hpux/B.11.11/

11.x/32bit
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.70/


Your other option is to look into sudo to distribute root privileges to other users:
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.7p5/


Pete

[Phil_2]

Thanks to all of you. The "lsof" command will probably work the best.

I have used the 'find' command, but not to the granularity required here.
The file in question is an Oracle archive log, and the need is to determine when it can be gzip'd after access by the DB is complete.

Thanks to all, please don't hesitate to add more to this thread if you think of anything else.

Thanks again.
Phil