I agree with Adrian. If this is on a Linux system, I'd suggest setting up "icrond" to monitor that file and at least record who is accessing it. In addition, I would suggest that said Linux system run with SELinux in "enforcing" mode. That can stop even "root" from updating something, if it doesn't have the proper SELinux credentials.
In our production setup we found new issue as postgreSQL.conf has become zero byte file.
After some time we copied that file from some back up, after some time it has again become zero byte.
Any clue what is the reason of this behavior.
I tend to doubt that Postgres is zeroing out its own conf file. My guess is some other program/script is doing that. If you can narrow down the time frame this happening, I would then look for any cron/scheduled jobs that are running at the same time.