Linux: find out which PID changed my file

# Install auditd
```bash
sudo apt install auditd
```

# Watch file
```bash
sudo auditctl -w ~/.recently-used -p w -k asdf
# -w watch /etc/hosts
# -p rwxa watch for write, attribute change, execute or read events
# -k "asdf" is a search key.
```
# Do some testing
# Search result
```bash
sudo ausearch -f ~/.recently-used | less
sudo ausearch -f ~/.recently-used | grep 'asdf' | grep ' pid='
ps -ef | grep 123456
```

# List audit rules
```bash
sudo auditctl -l
```
# Remove audit rule
```bash
sudo auditctl -W ~/.recently-used -p w -k asdf
sudo auditctl -l
```
*It is KeePass!*