How to tell what process accessed a file

[Wade Richards <wade@wabyn.net>]

Hi,

This isn't a major problem for me, but since it's related to auditing
file access, I thought the security people would have an answer.

Every once in a while I get a bunch of errors because some process tried
to access my CDROM, triggering automount when there's no disk in the
drive.

I'd like to figure out what program is doing this.  I've already spent a
lot of time searching through my cron logs, to no avail.

Is there any way to audit file access, so I can see (after the fact)
which program was responsible for trying to view "/var/autofs/misc/cd"?

Thanks,

    --- Wade

-- 
 /"\  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
 \ /   ASCII Ribbon Campaign    | Wade Richards --- wade@wabyn.net
  X   - NO HTML/RTF in e-mail   | Fight SPAM!  Join CAUCE.
 / \  - NO Word docs in e-mail  | See http://www.cauce.org/ for details.