[nycbug-talk] how to "watch" a file?

[Charles Sprickman]

Hi all,

I'm still tracking down a really weird problem, and each time I think I've 
got a line on the cause, it turns out to be a dead end.

In short, I've got a mail "toaster" running qmail w/vpopmail.  It's a 
pretty simple setup that leverages qmail's weird "-" aliasing.  It calls 
it's own delivery agent to handle final delivery.  All messages are stored 
in Maildir format, and quotas are enforced using the mechanism in 
Maildir++ which relies on size info being stored in a file called 
"maildirsize" in the root of the user's Maildir.

Problem:  Something is messing with this file and leaving it owned by 
root.  This breaks all sorts of things (overquota users can get more mail, 
imapd won't read it and report the quota in webmail, and other oddities).

I thought that I'd caught qmail-local running as root, which it should 
never, ever do.  But that may not be it as I have a wrapper in place that 
will bail and log if it's called as root.  So far I'm not seeing it trip, 
but I'm still seeing some users ending up with a root-owned maildirsize 
file.

I want to take a different approach - I've got some overquota/locked users 
that this happens to all the time.  Is there something I can put in the 
maildirsize location that will look/act like a file, but is not a file? 
Something that would record what process touched it and as who?

Any other ways to "watch" a file and record the above info each time it's 
manipulated?

Thanks,

Charles