How can you determine which process or user is writing data to a file in Linux without using logs?

To determine which process or user is writing data to a file in Linux without using logs, you can use the lsof utility or the inotifywait tool from the inotify-tools package.

1. lsof — shows which processes have opened the file:

lsof /path/to/file

This will display a list of processes that currently have the file open.

2. inotifywait — allows monitoring filesystem events, such as writing to a file:

inotifywait -m -e modify /path/to/file

In another terminal, you can run commands, and when the file changes, you'll see an event. Afterwards, you can again use lsof or ps to identify the process.

3. auditd — if available, you can set up auditing on the file to track write operations, but this is closer to logs.

Thus, combining inotifywait to detect the moment of writing and lsof to identify the process is an effective way without using system logs.