Thanks rockdalinux for your help.

I could figure out the logic but was getting stuck on how to do it using shell scripting since unlike c programming you cannot get into the internal functions of the kernel to work on fd ( or am i mook on this?)

However i found the command that would help me going in this direction.

Its pretty simple once i got hold of the command and the switch.

In this case to get access of the /etc files and the users who did it, i used the lsof command as shown below:

lsof +D /etc

One can use +d if you do want only listing of the files at the first level only

Now l i can filter the data with awk and sed. :P

But i am thinking if i could write a deamon for the same so that the script runs continously and logs the data to a log file. I am still an novice in writing deamons and wrappers with shell scripts .

Now time to work on it!

Thanks rockdalinux for sharing your thoughts on my problem