you can use fuser filename to see if file is in use it will
give you process id where you can check using ps -ef | grep process id to see who is using it
You can use istat command ( man istat) istat filename
to show you when it was last modified
if you have the HISTFILE variable set in your .profile
you can check users history to see if any one vi'ed , / changed your file.
The modification is appening during the night.
If there is not a built-in command I'll try your third suggestion. A deamon process with fuser can be a solution to.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.