I am working on a project related to VM migration. Sometimes the VM image will disappear and I just want to know who the culprit is. I tried strace on suspicious processes but to no avail.
Finally I found the answer here: http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html
The Linux Audit daemon will do the trick.
You can find out the PID of a process, which has some file open using
Once file is closed and deleted, you cannot get that information.
BTW. Keep in mind, that deleting a file is operation on directory it's in, not on a file itself.