nsswitch.conf file always corrupts somehow. I do restore from my backup every time it corrupt.When this file corrupts, its time stamp is changing. Now I wonder if there is a way to track that file ? I'd like to know which process or maybe user cause that corruption. Is there a way to do that ?
How to track file change
process;solaris;trace
You could either set up auditing or use DTrace. There are various examples how to use it to monitor file access on the interwebs, for example here.