I have a directory /some/dir, and I see that new files appear there all the time. How do I find out which process is creating those files?
auditctl -w /some/dir/ -p war -k whatsgoingon
That sets up a hook waiting for something happening under /some/dir/.
Then make sure you have
auditd daemon running. After that just wait until files appear and see from
/var/log/auditd.log or wherever it in your system writes and read what happened and by what process.