How can I find out which programs have modified a file over some period of time?

Solution 1:

This can be achieved with the fuser tool. It lists the process ID of all processes accessing a specific file. Try,

fuser -u .

...to see which files are "open" in your home directory, the process ID's involved and the username owning those processes.

In your case, I'm not sure this will be useful since you're trying to monitor a reboot. I suspect that rc.local will execute too late in the reboot to capture anything useful with, say,

watch -n 0.5 "fuser -u /var/lib/alsa/asound.state"

Hmm - I've just tried dumping this to a file and the output isn't very pretty. But if this can be resolved, then perhaps something can be achieved with cron?