Scrutinize file operations by process trees on Linux