Re: How to catch process that removes files?

["a.list.address@gmail.com" <a.list.address@gmail.com>]

lsof will show you currently open files, and of course you can pipe it
through grep.  If they aren't already opened, though, it might not
help.

I'd do a complete inventory of the files that get deleted, and then
check the permissions on all of them.  That might give you some clues.

You might also check your cron jobs.  rgrep through the /etc/cron*
directories and see if any of the missing filenames are there.

Another question is, how often does it happen?  Is it regular or
random?

You might also install tiger and see if it finds anything.  And, of
course, install logwatch and check its messages daily.  And make sure
you're getting the mail for root so you can see any warnings.  And grep
through your logs in /var/log.

Let us know if you find the culprit.