lsof will show you currently open files, and of course you can pipe it through grep. If they aren't already opened, though, it might not help.
I'd do a complete inventory of the files that get deleted, and then check the permissions on all of them. That might give you some clues. You might also check your cron jobs. rgrep through the /etc/cron* directories and see if any of the missing filenames are there. Another question is, how often does it happen? Is it regular or random? You might also install tiger and see if it finds anything. And, of course, install logwatch and check its messages daily. And make sure you're getting the mail for root so you can see any warnings. And grep through your logs in /var/log. Let us know if you find the culprit. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
