Check which process is modifying a certain directory or file
$ auditctl -w /path/to/directory -p war
See results
$ ausearch -f /path/to/directory
$ auditctl -w /path/to/directory -p war
See results
$ ausearch -f /path/to/directory