If logrotate (as Mark suggested) did not do it, you can use SystemTap to do this sort of things. There are sample scripts on the Internet that monitor file permission change. Maybe these help:https://www.sourceware.org/systemtap/SystemTap_Beginners_Guide/inodewatch2sect.html https://lwn.net/Articles/271796/ Yong