I'm trying to figure out which processes are deleting files from a specific directory on my CentOS server.

I looked at inotify, but all this does is to tell me how many file deletions are occurring; it does not tell me what process run by which user did the deletions, nor does it tell me when they happened.

I also tried auditd, but I have had no luck in getting it set up on my server.

Does anyone have any other tool they can suggest that will do this?