A large number of cracker files with name FOO** are created by some of the process. I executed following command to found culprit process lsof -f -F /tmp/*
But didn't found anything useful.
Is there any better way to catch culprit process.
lsof |grep FOO # should give a listing of processes that are creating at that time files with the name FOO
if there is not output from this you may need to setup a cronjob do list every minute - I'm thinking perhaps the process is not running all the time. if nothing comes up from this look when the files were created
look at the owner/permissions/modification time etc. and see if something may tell you something
You'll want to use the audit subsystem to track down the rogue process.