I'd like to better understand which programs are modifying a specific file1 during a reboot. Can I set something up to log this kind of information?
Polling for which processes currently have the file open won't work, as the file may only be open for a few milliseconds.
Can kernel tracing be used to collect this information?
/var/lib/alsa/asound.state if you're curious, but I'm interested in a general solution.