3 ms·

You can just use the find command for tracking writes, for example: find / -type f -printf '%TY-%Tm-%Td %TT %p\n' | sort (you probably want to add -mount in

You can just use the find command for tracking writes, for example: find / -type f -printf '%TY-%Tm-%Td %TT %p\n' | sort (you probably want to add -mount in there too and use find per each mount point separately)

tyingq 7y ago
Auditd would show frequency, the process name and uid that did the write, and when, etc. Last modified time isn't always enough.