Some files on a Debian 9 server periodically overwritten to the original status after I modified it. I couldn't find what process/program is doing that job. Nothing is defined on crontab. Posibilly from a remote server (i.e. Ansible/Puppet) but I cound't find evidence.
I tried to use
fuser but no process is using these files.
My question is how to setup a monitor to monitor these files and find out what process changed their contents.