I'm trying to find a reliable way of finding which process on my machine is changing a configuration file (
/etc/hosts to be specific).
I know I can use
lsof /etc/hosts to find out what processes currently have the file open, but this doesn't help because the process is obviously opening the file, writing to it, and then closing it again.
I also looked at
lsof's repeat option (-r), but it seems to only go as fast as once a second, which probably won't ever capture the write in progress.
I know of a couple tools for monitoring changes to the filesystem, but in this case I want to know which process is responsible, which means catching it in the act.