# Ubuntu – How to find the pid of the process which has deleted a file

processrm

I am working on a project related to VM migration. Sometimes the VM image will disappear and I just want to know who the culprit is. I tried strace on suspicious processes but to no avail.

sudo auditctl -w /path/to/somefile -p wra

ausearch -f /path/to/somefile -i