How to catch editing a file by a process, a user on a Linux server?

Question

linux

1. There was a file and it was gone.
2. The file has been edited unexpectedly.
How (what utility) to understand who or what was done?
Server hacking and malicious actions are 99% excluded, this is something happening inside the system.
I would like a solution like "logging everything that happens on the server" (who and when edited / added / deleted the file in the system).

Answer 1

Try Snoopy first.
If it does not help, then the script for inotify already.

Answer 2

rsyslog.d + inotify, in theory, you can write a small daemon that will catch file changes and write to the log who did it.

Answer 3

I like auditd, it's easy to set up and run, it can track almost everything that happens in the system (I kept track of who, what, when and with what parameters it starts).
ps and yes, you don't need to write anything yourself;)

Answer 4

Inotify for help en.wikipedia.org/wiki/Inotify
AND rus-linux.net/MyLDP/kernel/Inotify-tools.html

Answer 5