chown

[D. Versluis]

Hi,

Is it possible to see when the owner of a file has been changed?
On our HP9000/10.20 the file /var/adm/lp/log was changed from lp:lp to
root:sys.

Thanks!

[Melanie Goetz]

The closest you will get is ll -c which will reflect the modification date/time
for the inode. However, this is also impacted by other commands, so could be
inconclusive. If you are running a trusted system, then there are additional
options for watching when and by whom certain things occur. Without this or
possibly some other 3rd party monitoring tool, nothing will specifically tell
you when a chown is performed.

Best regards,

Melanie

[Melanie Goetz]

The closest you will get is ll -c which will reflect the modification date/time
for the inode. However, this is also impacted by other commands, so could be
inconclusive. If you are running a trusted system, then there are additional
options for watching when and by whom certain things occur. Without this or
possibly some other 3rd party monitoring tool, nothing will specifically tell
you when a chown is performed.

Best regards,

Melanie