<br><br><div class="gmail_quote">On Mon, May 16, 2011 at 7:45 PM, Greg KH <span dir="ltr"><<a href="mailto:greg@kroah.com">greg@kroah.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Mon, May 16, 2011 at 03:02:10PM +0530, V.Ravikumar wrote:<br>
><br>
> Hi all,<br>
><br>
> (Note : I'm writing this mail to this kernel group as I did not find any<br>
> suitable mechanism in application level for my below need).<br>
><br>
> If a file modified by some user then how can we detect that user who modified<br>
> it.<br>
><br>
> Linux audit was not suitable for my need.<br>
<br>
</div>Why not? It should have showed you this exactly.<br>
<br>
</blockquote></div><br>For my need, I have to asynchronously notify if a given file was modified by some user using some program.<br>
<br>As per my understanding for audit , one has to update system
specific audit configuration files(say using some auditd related command
line tools) with given file and it is not suitable for my requirement.<br>
<br>
Is there any other ways apart from using SystemTap and auditd command line tools.<br>
<br>Thanks for all your suggestions so far.<br><br>Regards,<br>Ravikumar<br><br>