I came across two interesting links to find out the files being changed by process in Linux.
http://fileschanged.sourceforge.net/http://sourceware.org/systemtap/wiki/SystemtapOnUbuntu. This has a war stories link that looks very interesting - (
http://sourceware.org/systemtap/wiki/WarStories