Detecting directory changes on unix

Question

How can I track changes to a specific directory on UNIX? For example, I run some utility that creates some files during its execution. I want to know which files were created during one run. Is there an easy way to get this information? The problem is that:

• I cannot clear the contents of the directory after running the script
• Files created with a name with a hash as part. There is no way to get this hash from a script for later retrieval.
• Sometimes several scripts may be executed, I do not want to see files created by another process in the same folder.

Note that I do not want to know if the directory has been changed, as indicated here , I need file names that could ideally be grepped to match a specific pattern.

Answer 1

You need to sign up for file system change notifications .

Answer 2

You should use something like FAM, gamin or inotify to detect when the file was created, closed, etc.

Answer 3

You can use strace -f myscript to track all system calls made with a script, and use grep to filter system calls that create new files.

Answer 4

You can use the script command to track running commands.

Answer 5

You can use the Linux audit system. Here's a link:

http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html