Monitor File Access in Ubuntu

# auditd: can record who access the files, but cannot notify immediately
sudo apt-get install auditd
sudo vi /etc/audit/audit.rules # to add files to monitor; man audit.rules to check the grammar
sudo service auditd restart
sudo ausearch -f <file-name>


# inotifywait: cannot record who accesses the files, but can notify immediately
sudo apt-get install inotify-tools
inotifywait -m /etc/cron.d # can be a directory or file

# Check opened files in a ongoing process

lsof -p <pid>

strace -p <pid>

References:

How to monitor file access on Linux with auditd

Continuously monitor files opened/accessed by a process