Check which process is modifying a certain directory or file

  $ auditctl -w /path/to/directory -p war

See results

  $ ausearch -f /path/to/directory
click the source code to copy