Possible Duplicate:Is it possible to find out what program or script created a given file? How do I monitor the file system for specific purposes?For example, I read that shutdown (when called with a delay) creates the file /etc/nologin to prevent login from accepting new users.If I were to verify this, is there a tool I could ask, and then it would say, That's right, between X and Y there was such a file and it was accessed 4 times - ?
Monitor file system
filesystems