How to monitor what files are opened

You could perhaps use audit system for that. It is a little heavyweight, but something like this should work (in /etc/audit/audit.rules):

# delete all other rules
-D

# watch the file in question
-w /path/to/file -p rwxa

and then I think you need to restart auditd:

sudo service audit restart

(In case you don't have it installed, it is in package auditd.) The culprit can then be found in /var/log/audit/audit.log.

Related