On Tue, Oct 24, 2017 at 11:49:21AM -0500, David Wright wrote: > > Perhaps you could watch the file with inotifywait, and capture > a ps and maybe even a lsof listing at that moment. > I have both inotify-hookable and incrond watching the file and the output of `lsof /etc/resolv.conf` and `ps -ef` triggered by both of those for any access if resolv.conf (whether read or write) does not show anything related to resolv.conf at all, except for the incron and inotify-hookable processes watching the file.
Regards, -Roberto -- Roberto C. Sánchez