How can I know which files were modified by a specific process in linux machines?

Question

I need to get list of all modified files on my linux machines (AIX, Solaris, Red Hat, CentOS, HP-UX) in a specific time range (similar to proc mon or forfiles in Windows)

I tried to use find command. But since it didn't search per specific PID I got too many results. I wanted to narrow down the results by looking for files that were modified by specific process. I used the lsof command for specific PID. but I got list of files that were accessed, which wasn't helpful for me, because I could not know if the process changed them. I tried the strace command for specific PID, but the output was to hard to work with (too much irrelevant info, and I need it for 24 hours time range)

I kind of got to a dead end. Any ideas? (In short - I want to get list of all modified files by a specific process in a specific time range)

Answer 1

Linux does not maintain a log of a record, of any kind, of which files were modified by which process.

The only logged information is each file's last modification timestamp. And even that can be arbitrarily adjusted by any process, which has appropriate privileges, to be ten years in the future, for example.

The short answer is that the information you're looking for does not exist.

Answer 2

The closest what I know of for your usecase is SELinux. This will only work if SELinux is enabled on your Operating System.

SELinux is capable of logging a bunch of information along with uid, gid, and PIDs ( exactly what you need ) for different operations.

For more details look at:

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sec-Understanding_Audit_Log_Files.html