Is there a tool to monitor what processes open what files on the system so you can track down which process keeps touching a specific file?
Lsof can find out if you run it while the process has the file open, but if it is a short lived process that runs every once in a while, you can't catch it with lsof. Need something that uses kernel tracing.