inotifywait， 使用inotify来等待发生文件更改。
# inotifywait -m ~/ Setting up watches. Watches established. /home/k4nz/ OPEN .ICEauthority /home/k4nz/ ACCESS .ICEauthority /home/k4nz/ ACCESS .ICEauthority ...
补充说明
如果想要知道哪个进程修改了文件，需要使用 auditd 工具。
参考文献
man 1 inotifywait, version 3.14
shell script – How to use inotifywait to watch a directory for creation of files of a specific extension
linux – Find which process is modifying a file – Unix & Linux Stack Exchange