pyinotify file deletion user

Question

I'm trying to use pyinotify to alert me whenever files are deleted, but I want to know what user deleted the files. Is there a way to find this information?

Answer 1

That information isn't exposed by the underlying inotify system. This is the main change notification API for the Linux kernel, so you aren't going to find another notification system that provides this.

If you want to track who deleted the file, it would be easiest to make the deleter announce what it is going to do. If you don't have control over the deleter (that is, you still have to maintain a POSIX interface for deleting the file), you could look at writing a custom file system wrapper in FUSE, which might expose the UID of the process that called unlink().