how uncover what start iptables?

[Frantisek Hanzlik]

I have disabled (not masked) iptables.service on F17 box.
But occasionally are this services started. There isn't any
record about it in system logs. Is there some (systemd native)
manner how detect who start this service?
(maybe via inotify tools I'm able detect access to
"/etc/sysconfig/iptables", but this give no information about
accessing process)

Second question about iptables: Is there any replacement for
"service iptables panic" command from old gold cheerful non-systemd days?

Thank in advance, Franta Hanzlik