how to find out which script/program change file?

shyjack

Hi there,

In my system, sshd was deleted from /etc/group during the system reboot, hence cause sshd service failed to start.  It can be fixed by manually add sshd back to /etc/group file.

I had went through all the rc script and system services but no luck to find any clue.

The system is solaris 10 with patch level 125100-08.

Just wonder if there is a way that I can audit which process/script/program delete sshd group during system reboot.  I mean setup some monitor script and then reboot again to find out how the sshd group will be deleted?

Thanks.