How to catch process that removes files?



Can anyone recommend a piece of software that will watch a file or a
directory and tell me what processes mess with the files in there? In
particular, I'd like it to react when a file is removed.

I tried dnotify but it only tells me that it happened, after it
happened, not who did it.

I need this because on this one Debian testing server I have a problem
that's driving me mad: something comes around and periodically removes
files from /var dirs, making certain services crash and burn: Samba
tdb files, Apache SSL mutex, MySQL and Postgres runtime files and so
on. And I can't figure out who the hell is doing that.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx



Relevant Pages

  • Re: Postfix against spam
    ... I recommend joining the mailling list and reading the archives. ... > for solutions to fight spam using Postfix running on FreeBSD 4.8. ... > To unsubscribe, send any mail to ...
    (freebsd-questions)
  • Re: Running testing? -- read this.
    ... On sidux running Debian sid, it was recommended to do a 'apt-get dist-upgrade' regularly (ie, every few ... how frequently would you recommend i do this. ... runs a script that makes the process, and troubleshooting, easier for users who aren't as experienced. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • Re: IMAP Server suggestions
    ... Can anybody recommend which IMAP server to install? ... To unsubscribe, ...
    (freebsd-questions)
  • Re: is it a bad idea to use unstable on a server ?
    ... If so, would you recommend using testing, or stable? ... And does anyone with experience running unstable on production ... servers know of any other caveats I should be aware of? ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • Re: Open (helper application chooser) for iceweasel/icedove is too simple
    ... so you have to type slowly and watch what it's ... I can't reproduce this. ... directly at the app I want it takes 30 seconds to find it!! ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)