Quote: Original post by spraff
Hi. I want to get a list of whatever processes recently accessed a given file (by name or descriptor) or block device. Where is this information logged? Do I have to enable a certain type of logging?

There's no way to get a list of processes that recently accessed a filesystem object or a device because that's done by the kernel, not a process. There may be a way to get the kernel to report what process made what system call, but that's not necessarily useful information since processes come and go rapidly and you're going to have difficulty mapping pid to programs after the process is gone.

What you can do quite effectively on Linux at least is to watch an inode for various transitions and try to capture which process is acessing the file at that point. Use the inotify calls to watch the inode. You are still liable to race conditions so your information is not guaranteed to be completely accurate, but at least you'll be able to get a good idea of file activity.

Quote: Original post by spraff
Hi. I want to get a list of whatever processes recently accessed a given file (by name or descriptor) or block device. Where is this information logged? Do I have to enable a certain type of logging?

For what purpose do you need to do this?