Linux audit files to see who made changes to a file - nixCraftHow do I audit file events such as read / write etc? How can I use audit to see who changed a file in Linux? The answer is to use 2.6 kernel’s audit system. Modern Linux kernel (2.6.x) comes with auditd daemon. It’s responsible for writing audit records to the disk. During startup, the rules in /etc/audit.rules are read by this daemon. You can open /etc/audit.rules file and make changes such a
