Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Chris Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Help in System Call
- Thread starter amarg
- Start date
You seem to be trying several approaches - what's your real question?
thread80-559716
> last_access_process for that file ?
You could modify your OS to store the PID (assuming you have linux)
But process IDs are re-used, so they are not unique in the long run.
You could match that up with the accounting information, but the owner of the program may have deleted / changed the program.
If you can't store the PID, the best you can do is 'guess' which program (of those active at the last access time of the file) was responsible for the access. You need a good accounting log to record the start/stop times of each process.
Bear in mind that something like a backup could be started many hours before it actually gets around to touching your file.
thread80-559716
> last_access_process for that file ?
You could modify your OS to store the PID (assuming you have linux)
But process IDs are re-used, so they are not unique in the long run.
You could match that up with the accounting information, but the owner of the program may have deleted / changed the program.
If you can't store the PID, the best you can do is 'guess' which program (of those active at the last access time of the file) was responsible for the access. You need a good accounting log to record the start/stop times of each process.
Bear in mind that something like a backup could be started many hours before it actually gets around to touching your file.
- Status