Monitor which process changed the file

Question

I want to know which process changed files in some directory.

I had a look at inotify-tools, but it doesn't show the pid. I also look at fileschanged utility, but in my case it doesn't show anything at all, even that change happened.

Is there solution?

Answer 1

Take a look at fatrace written by Martin Pitt.

It will monitor all system-wide reads/writes/opens/closes alongside the PIDs and the names of their processes.

1. Get it:

   bzr branch lp:fatrace
   

2. Build it:

   cd fatrace
   make
   

3. Run it:

   sudo ./fatrace -t | grep "/path/to/your/file"