> Anybody has an advice howto find out who is creating these links? > > Kind regards > Try using auditd. Something like: sudo auditctl -w /some/file -k test-audit -p rwxa then later sudo ausearch -f /some/file -Jeff