Use auditd Install auditd to find out what modifies the file on Ubuntu

 Start the daemon (sudo service auditd start) and tell it to watch for modifications to that file:

sudo auditctl -w /etc/resolv.conf -p w

Audit logs are in /var/log/audit/audit.log. You'll see the time the file was modified and the name of the program that modified it.

Featured Post

Facebook Unable to Identify Who Was Behind Network of Fake Accounts

Facebook said Tuesday it had been unable to determine who was behind dozens of fake accounts it took down shortly before the 2018 U.S. midte...