Finding process updating a file

[new2unix]

Hi,

There is a file, let's call it "newbie.dat" on my AIX box that is periodically being access and updated. Is there a way (command, scripts, etc) that I can use to find out what program or process updates this file?

Thanks

Mike

 

[RobJordan]

This requires access to lsof command. (list open files)
Works for finding TCP connections as well.

$ vi test.txt

$ ps -ef|grep test.txt|grep -v grep #search for the process
jordanro 18180 19044 0.0 13:57:37 ttyb9 0:00.02 vi test.txt

$ lsof -V|grep 18180 #run lsof against the PID

vi 18180 jordanro cwd VDIR 2552,501377 8192 85065 /usr/users/jordanro
vi 18180 jordanro txt VREG 3113,970202 294912 17645 /usr/bin/edit
vi 18180 jordanro txt VREG 2707,1035594 139264 337 /sbin/loader
vi 18180 jordanro txt VREG 2707,1035594 1663440 487 /shlib/libc.so
vi 18180 jordanro txt VREG 3113,970202 524288 1426 /usr/shlib/libcurses.so
vi 18180 jordanro 0u VCHR 6,201 0t1498 6928 /dev/pts/201
vi 18180 jordanro 1u VCHR 6,201 0t1498 6928 /dev/pts/201
vi 18180 jordanro 2u VCHR 6,201 0t1498 6928 /dev/pts/201
vi 18180 jordanro 3u VREG 2993,760628 0 8087 /var/tmp/Ex18180

Robert

 

[new2unix]

Hi, Robert,

Thanks for the reply. The lsof command is not available on my AIX server. Also, it looks like the lsof command needs to be issued while the file updating process is taking place, but I will not be able to tell when the file will be updated. I was looking for a way to find out who or what process modify the file. I wonder if I should set up a cron job preiodically running a simple script that has the ps and grep commands to check if the file is being opened. That didn't sound like a good approach.

Mike

 

[MikeLacey]

Mike,

Isn't there an audting thing you can turn on in AiX and watch accesses to an individual file? Mike
michael.j.lacey@ntlworld.com
Email welcome if you're in a hurry or something -- but post in tek-tips as well please, and I will post my reply here as well.