howto monitor a program creating links in /tmp?

[Jeff Raber]

> Anybody has an advice howto find out who is creating these links?
> 
> Kind regards
> 

Try using auditd.  Something like:
	sudo auditctl -w /some/file -k test-audit -p rwxa
then later
	sudo ausearch -f /some/file

-Jeff