1

Possible Duplicate:
Is it possible to find out what program or script created a given file?

How do I monitor the file system for specific purposes?

For example, I read that shutdown (when called with a delay) creates the file /etc/nologin to prevent login from accepting new users.

If I were to verify this, is there a tool I could ask, and then it would say, "That's right, between X and Y there was such a file and it was accessed 4 times" - ?

Community
  • 1
Emanuel Berg
  • 6,763
  • 7
  • 43
  • 65
  • 3
    You might get some ideas by searching this site for `inotify` or the `auditd` system. – jw013 Jul 25 '12 at 01:58

1 Answers1

3

On systems that support it (Solaris, Free/NetBSD, Mac OS/X, Oracle Linux), a simple dtrace script would be a useful tool for this task.

jlliagre
  • 60,319
  • 10
  • 115
  • 157