1

I have a javascript file that is used on just one occasion -> if the home folder is deleted and i login the next time. I want to find the mechanism/tool/programm/application which has accessed/used (in the past not at the moment) this js file (file that has an impact on the plasma5 kicker startmenu).

Maybe there could be an easier way to solving this specific "login js file" situation but i would very much like to know how to find an unknown programm which has used a given file. Kind of like a "reverse strace".

Rui F Ribeiro
  • 55,929
  • 26
  • 146
  • 227
Deacon Frost
  • 11
  • 2

2 Answers2

0

You can use the fuser command,

fuser file_name

To find out the list of processes using the file.

Stack EG
  • 1,508
  • 1
  • 11
  • 13
  • Thanks very much, i know fuser helps to identify processes that are "blocking" a file. But as i understand fuser, it can not tell which processes used the file last and it shows no multi level hierachy like strace does it. So, it works in the present but not in the past. On the other hand, maybe i am not using it right? – Deacon Frost Sep 25 '18 at 05:26
0

I want to find the program which has accessed (in the past not at the moment) this js file

You cannot find this information retrospectively.

If you have auditd installed you can identify which processes have run, but not what files they accessed. sar will give similar types of information but more generally about the system.

If you can force the issue to repeat then a tool such as inotifywait may run quickly enough to capture details of the process accessing your JS file.

Also see What information about a process is retrievable after it is terminated?

roaima
  • 107,089
  • 14
  • 139
  • 261