last file modification

[matteo_4]

Hi all,
i want to know if it's possibile to see

wich user make the last modification on a file or on a directory.

best regard

matteo

[Arturo Perez del Galleg]

For this, i think, you must to enable the system auditing.
Go to man for:
audisp
audusr
audevent...
or directly from SAM.
HTH

[Armin Feller]

Hi,

check the .sh_history of all users on the system and grep for the filename, perhaps you find the user.

Regards ...
Armin

[RAC_1]

there are three times associated with file
atime - access time
ctime -change time (once you modify file you can not know creation time)
mtime - modification time.
Back to permissions-user's ability to modify file depends on permissions given, so accordingly you can check who modified file.