monitoring file access

[Marco Salvi]

Anyone know how to monitoring what process access a file?
I tried with fuser but it doesn't fit my need.
I need some utility that create a list of the all process that have accessed a specific file.

[Victor BERRIDGE]

Hi,
What about lsof then, if you dont have it you will have to go to your prefered porting archive center and download the product...


All the best
Victor

[Mahesh Kumar Malik]

Hi Marco"

"lsof" a contributory utility may be of help to you. Please visit following link for download

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.76/

Regards
Mahesh

[Steven E. Protter · Accepted solution]

finding this out is a multi step operation.

fuser -cu /filesystem

can show open processes on a filesystem.

lsof can provide data on processes and is pretty useful.

But all processes that have accessed a specific file? Maybe if the system was trusted, you could set up auditing reports to do that for you.

HIDS/9000 comes to mind, but I'm not sure either is the right tool for this job.

SEP

[Vibhor Kumar Agarwal]

A file doesn't have any indication of what processed accessed it in the past.

You can get the no. of processed accessing it at a particular snapshot.

Or simply run a script via cron which appends that to a log.

[RAC_1]

lsof will give details about open files hold by a process. Once process is completed, you won't get any details.

Get lsof from following.

http://hpux.connect.org.uk

[Jannik]

the lsof is the best choise:
http://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/lsof/binaries/hpux/
use this download it works!

[Alessandro Pilati]

Marco,
here you can download directly the binaries of lsof:

http://www.mirrors.wiretapped.net/security/host-security/lsof/binaries/hpux/

Ciao,
Alessandro

[Alessandro Pilati]

Here you have a lot of Faq and answers about lsof:
http://www.mirrors.wiretapped.net/security/host-security/lsof/FAQ

Regards,
Alessandro

[Marco Salvi]

Thanks a lot for the answers, anyway lsof doesn't help me.
lsof can't report when a file is opened by the vi editor, so all the processes that have a behaviour similar to vi are not be catched by lsof.

[Srimalik]

I am not sure if this will be acceptable to u but anyways:

you can try HIDS( Host intrusion detection system).
create rules on the filename.

[Srimalik]

oops this thread is 2 yrs old.