How to determine which program is generating a file in Linux?

Question

linux

Let's consider 2 situations:
1) The file has already been created, and it is necessary to determine which program creates it
2) The file is generated with a certain frequency (say, every 10 minutes). It is necessary to "intercept" this moment and find out what kind of program creates it

Answer 1

While the program is working with the file, it keeps it open. Monitor lsof.
Or, if you suspect a particular program, run it as a unique user. The files it creates will be owned by that user.

Answer 2

in the first case, set up an audit in advance and look for a file access event in /var/log/audit.log
; in the second case, inotify.