Hello

Would you tell me how to find which program that update a specific file?
I am implementing migration project.
My machines OS are AIX.
It is because lack of documentation, some program cannot working properly on new machine.
We found the root cause of this problem is that some data files are not update properly,so I want to install program on old machine to find out which program(s) would update a specific file.

ps: I am just a normal user (not root) in both new and old machine.

If you need to know what program is actively using a file, try installing lsof (or get your Admins to do this).

If you want to see who modified (past tense) a file, you will need some sort of accounting or auditing enabled.
This will be trickier than you think I imagine.

gts is right - auditing a system can be tricky. Still, if you have only one (or very few) file(s) to monitor you can probably set up a loop with "lsof" and a log file, which might "catch" the offending process in the act. In any way, finding out which process modified a file in the past is impossible. You can only wait for the process to modify it again and then "catch" it while it does so.

I hope this helps.

bakunin

with audit, a sample configuration I have done a few months ago
the file to audit is /db2/SID/sqllib/db2systm in this case

hostname:/etc/security/audit--# cat objects
/db2/SID/sqllib/db2systm:
       r = "FILE_Open"
       w = "FILE_Open"



nohup  /usr/sbin/auditstream | nohup auditpr -v > /fs/audit/stream.out &

audit enable
audit start

I found lsof command on my machine it solve my problem.
thank you very much