TransWikia.com

Is there any way to find out which user has tried to access specific file and got permission denied error

Ask Ubuntu Asked by Tashkhisi on December 31, 2021

I want to know which user has tried to access specific file and consequently got permission denied error. Is there any way to do that in Ubuntu?

2 Answers

I believe you can configure rules to do what you're asking with auditd(auditctl).

I can't help with it beyond this, because my only experience with it was shutting it off when it was killing my machine due to the excessive logging. But they seem to have solved this problem (at least back then): https://unix.stackexchange.com/questions/220250/using-auditd-to-capture-permission-denied-notices

Answered by WU-TANG on December 31, 2021

No. A simple failure to open a file is a process-related issue, not a system issue. The process trying to open the file is the only one that knows the open failed.

Since "permission denied" is a valid return status, and happens often, it's not logged.

Answered by waltinator on December 31, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP