Probably isn't the answer you are looking for but if somebody is doing things such as touching lock files for your network monitoring script you should probably know about it anyway :) As far as I am concernced if the box you are using as a network monitoring station has malicious users on it you have bigger problems. If the file is there and isn't owned by you have it e-mail you...