I'd like to better understand which programs are modifying a specific file1 during a reboot. Can I set something up to log this kind of information?
Polling for which processes currently have the file open won't work, as the file may only be open for a few milliseconds.
Can kernel tracing be used to collect this information?
1 /var/lib/alsa/asound.state
if you're curious, but I'm interested in a general solution.