Possible Duplicate:
Is it possible to find out what program or script created a given file?
How do I monitor the file system for specific purposes?
For example, I read that shutdown
(when called with a delay) creates the file /etc/nologin
to prevent login
from accepting new users.
If I were to verify this, is there a tool I could ask, and then it would say, "That's right, between X and Y there was such a file and it was accessed 4 times" - ?
inotify
or theauditd
system. – jw013 Jul 25 '12 at 01:58