pid of last process access a file

[Lai Nee Shyang_1]

Hi There,

Anyone know how can I determine the pid of the last process that access a particular file ?

Thanks

Lai

[Tom Geudens]

Hi,
Well frankly I don't think that information is available. The "lsof" tool (search the forums for more information) can show which processes have opened which files, but showing which processes last altered a file ... I don't think so.

Can anyone else prove me wrong ?

Regards,
Tom

[Michael Tully]

I agree with Tom, once the process has terminated there is really no way to determine exactly who/what had the file open. You can guess of course if the file has been created, it may have an ownership of a user. I am fairly sure that there is nothing in the system accounting/auditing that does this either. The only tool(s) available that I know that trace processes and files open are 'lsof' and 'tusc'. Both are available in depot format from the HP porting centre.

http://hpux.connect.org.uk/

[Lai Nee Shyang_1]

Thanks guys. I think I'll use lsof.. better than nothing.

Cheers..

[Deepak Extross]

My take on this is that you won't find a way to do this. It would be pointless for the OS to store the PID of the process that last accessed a file because by the time one accesses this information, the PID may be invalid! Your process may have died, or worse still, a new and altogether unrelated process may have been created with this same PID (recycled).
It's generally not a very good idea to store PIDs, so just be a little careful with this.

[doug hosking]

tusc, HP-UX auditing or the IDS/9000
intrusion detection products are perhaps the closest you will find to what you're looking for in anything provided by HP. None
of these really provides a bulletproof,
easy-to-use way of tracking this.

Perhaps we could be of more help if you
gave a bit more information on what
you are really trying to accomplish.
(Finding out who corrupted a file?
Spotting malicious activity?)

[Martin Johnson]

It would be easy if you were running OpenVMS: put an ACL on the file and turn on auditing. However, if you were to do this for every file on the system, you would need a very powerful system with lots of disk space for the audit file.

:-)
Marty

[Roger Baptiste]

Hi,

As others have mentioned it is not possible to do this. But, if you have an idea on what sort of process could have accessed the file,you can use perfview to list all the processes which were running at any time in the past and search that list for a match.

HTH
raj