how to find out which script/program change file?

shyjack

Hi there,\r\n\r\nIn my system, sshd was deleted from /etc/group during the system reboot, hence cause sshd service failed to start.  It can be fixed by manually add sshd back to /etc/group file.\r\n\r\nI had went through all the rc script and system services but no luck to find any clue.\r\n\r\nThe system is solaris 10 with patch level 125100-08.\r\n\r\nJust wonder if there is a way that I can audit which process/script/program delete sshd group during system reboot.  I mean setup some monitor script and then reboot again to find out how the sshd group will be deleted?\r\n\r\nThanks.