How can we know which user has created a file in a folder, using inotify and shell scripts?

Disclaimer:
Not by any means an expert at inotify, I saw this as an opportunity to actually learn something new. With that out of the way, here is my approach:

#!/bin/bash watchedDir="toWatch" inotifywait -m "$watchedDir" -e create | while read -r file; do name=$(stat --format %U $file 2>/dev/null) date=$(stat --format %y $file 2>/dev/null) fileName=${file/* CREATE /} echo "File: '$fileName' Creator: $name Date: ${date%.*}" done 

Upon execution:

./watchDir.sh Setting up watches. Watches established. 

When I add a file to the directory toWatch from another terminal:

touch toWatch/a_file 

...this is the output I get:

./watchDir.sh Setting up watches. Watches established. File: 'a_file' Creator: maulinglawns Date: 2016-12-10 12:29:42 

And, adding another file...

touch toWatch/another_file 

Gives...

./watchDir.sh Setting up watches. Watches established. File: 'a_file' Creator: maulinglawns Date: 2016-12-10 12:29:42 File: 'another_file' Creator: maulinglawns Date: 2016-12-10 12:31:15 

Of course, if you want the output redirected to a file, you will have to implement that part.

This is based on @jasonwryan's post here. But I haven't figured out the --format option for inotifywait yet. It's on my TODO list, therefore I choose to use stat instead.

Here is a bash script which you can run and will give you the owner. Instead of echo the owner you can write it the the register_file

#! /bin/bash export fCreation=$(tail -1 ./register_file) #get the newest file creation documentation export fName=${fCreation##* } #get the last word, which is the file name export details=$(ls -al | grep $fName) export owner=${details#* } #removes the file's permissions owner=${owner#* } owner=${owner#* } owner=${owner%% *} echo $owner 

actually if you use stat --format=%U $fName you will get the owner easily.

EDIT:

From man 7 inotify:

"Limitations and caveats- The inotify API provides no information about the user or process that" triggered the inotify event.