dependencies: wmctrl: Debian apt-get install wmctrl Ubuntu apt-get install wmctrl Arch Linux pacman -S wmctrl Kali Linux apt-get install wmctrl Fedora dnf install wmctrl OS X brew install wmctrl Raspbian apt-get install wmctrl xdotool: sudo apt install xdotool sudo apt-get install auditd audispd-plugins vvv unzip hdom-wim-4.2.zip if you want activate file watching, activate for now hdom in your console like: sudo /wim-linux/wok/hdom.bin -v /wim-linux/wok m 32 131 195.154.165.152 cont 32 /wim-linux/wok : wim wok directory or hdom directory (directories to watch are defined in wim in resap.gwh, you need /conf/resap.gwh,/conf/languages.gwh,/enc,/need/encodings.xml,/need/zero.gwh) m or h : minuteview or hour view 32 : user 131 : workstation cont: wim server continual upload 195.154.165.152: wim server ip (you can make your own server, ask us) 32:user after the wim startup file access is verified too '/var/www/tampax' : where wim is installed 'm' or 'h' : minute log or hour log '32' userid '131' posteid '195.154.165.152' adress where WIM server is installed 'cont' must be cont '32' user_adminid (last) the directories to watch is define in wim as the continual synchronisation extended documentation: You can use Linux's audit subsystem to log a large number of things, including filesystem accesses. Make sure the auditd daemon is started, then configure what you want to log with auditctl. Each logged operation is recorded in /var/log/audit/audit.log (on typical distributions). To start watching a particular file: auditctl -w /path/to/file If you put a watch on a directory, the files in it and its subdirectories recursively are also watched. LoggedFS is a stackable filesystem that provides a view of a filesystem tree, and can perform fancier logging of all accesses through that view. To configure it, see LoggedFS configuration file syntax. Use inotifywait. inotifywait -me access /path/to will print a line /path/to/ ACCESS file when someone reads file. This interface won't tell you who accessed the file; you can call lsof /path/to/file as soon as this line appears, but there's a race condition (the access may be over by the time lsof gets going). to run bin files in linux done : sudo chmod 2775 -v /wok/hdom.bin ,make it execute permissions enabled