On platforms where there is a timestamp for when a
file was last viewed (includes most UNIX systems)
you can check the access timestamp
returned by stat or -A. Note that this
timestamp can be manipulated, and that the sysadmin
may be able to bypass the timestamping mechanism entirely. | [reply] |
Good point wog, this is particularly true of backups. It
is possible for the sysadmin to backup all your files,
restore them to a different location and do whatever they
want to the copies. This type of activity would leave no
trail that you could follow.
@a=split??,'just lose the ego and get involved!';
for(split??,'afqtw{|~'){print $a[ord($_)-97]} | [reply] |
Or, taking what you said a different way -- the sysadmin, doing the routine nightly backups, could throw the timestamp off too.. leaving you unsure if it was an automated process which touched the file, or a person manually looking at it.
Backups, tripwire, the "locate" DB, and several other nightly processes can all interfere with it.
-Eric
| [reply] |
-A 'file' will give you how many days ago file was accessed...
maybe better for reading would be to use the stat() function to get the access time in seconds since the epoch (same type of output as time()) here is a simple script...
#!/usr/bin/perl
print qq`
Usage: $0 <files to check>
`;
for(@ARGV) {
printf("%24s was last accessed on %s\n",$_,scalar localtime((stat
+$_)[8]));
}
- Ant
- Some of my best work - Fish Dinner
| [reply]
[d/l] |
#!/usr/bin/perl -w
use strict;
die "Usage: $0 <files> ...\n" unless @ARGV;
my $res = map { printf("%24s last accessed on %s.\n", $_,
scalar localtime( (stat)[8] )); } @ARGV;
| [reply]
[d/l] |
Checkout perlfunc:stat which will give you the status of a filehandle. This includes modify/access times, permissions, etc. | [reply] |
