Linux: find out which PID changed my file
# Install auditd ```bash sudo apt install auditd ``` # Watch file ```bash sudo auditctl -w ~/.recently-used -p w -k asdf # -w watch /etc/hosts # -p rwxa watch for write, attribute change, execute or read events # -k "asdf" is a search key. ``` # Do some testing # Search result ```bash sudo ausearch -f ~/.recently-used | less sudo ausearch -f ~/.recently-used | grep 'asdf' | grep ' pid=' ps -ef | grep 123456 ``` # List audit rules ```bash sudo auditctl -l ``` # Remove audit rule ```bash sudo auditctl -W ~/.recently-used -p w -k asdf sudo auditctl -l ``` *It is KeePass!*