lsof? fuser? wrap the whole thing in exec or cron like you mentioned?

On Mon, Feb 28, 2011 at 6:33 PM, Kurt Granroth <
kurt+plug-discuss@granroth.com> wrote:

> I need to be able to monitor a file to see when it changes and, more
> importantly, what process is making that change.  Specifically, I run the
> SpiderOak utility every night but *something* (maybe itself) is corrupting
> or rewriting a critical file just before it runs.  I need to know what it is
> that is doing that change.
>
> Tripwire will monitor the file and tell me that it changed... but I already
> know that.  I didn't see any obvious way to get it to tell me who changed
> it.
>
> radmind looks like it might be able to do that... but that's a sledgehammer
> approach that I'd rather avoid.
>
> Maybe incron (cron version of inotify) could trigger a script that runs
> 'stat' on the file.  Still wouldn't give me the "who", though.
>
> What am I missing?
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>