I know this is an old question, but I'll suggest another approach just in case someone finds it useful. I originally posted this as an answer to a question that was duped to this one.
One option is to use
sysdig: an open-source system monitoring application. Using it, you can monitor for activity on a file by name. Suppose that you wanted to see what process was creating a file named
# sysdig fd.name=/tmp/example.txt
567335 16:18:39.654437223 0 touch (5470) < openat fd=3(<f>/tmp/example.txt) dirfd=-100(AT_FDCWD) name=/tmp/example.txt flags=70(O_NONBLOCK|O_CREAT|O_WRONLY) mode=0666
567336 16:18:39.654438248 0 touch (5470) > dup fd=3(<f>/tmp/example.txt)
567337 16:18:39.654438592 0 touch (5470) < dup res=0(<f>/tmp/example.txt)
567338 16:18:39.654439629 0 touch (5470) > close fd=3(<f>/tmp/example.txt)
567339 16:18:39.654439764 0 touch (5470) < close res=0
567342 16:18:39.654441958 0 touch (5470) > close fd=0(<f>/tmp/example.txt)
567343 16:18:39.654442111 0 touch (5470) < close res=0
From that output, you can see that a process named
touch with pid 5470 opened the file.
If you want more information, you could run in "capture mode" where a system call trace is collected:
# sysdig -w /tmp/dumpfile.scap
Then wait for the file to be created, then stop
sysdig and run:
# csysdig -r /tmp/dumpfile.scap
That'll let you explore everything that happened. You can press
<F2> and select
Files, the press
<F4> to search for the filename, then press
<F6> to "dig" (which will show you output similar to the command above). With that, you can then use the same approach to find information about the process that actually created the file.
There's a GUI version of
sysdig-inspect, if that's more your cup of tea.