Debugging how symbolic link is getting broken in ubuntu 16.04?

I have a symbolic link of the form

ubuntu@platform1:~$   ls -lrt total 28 drwxr-xr-x  4 ubuntu ubuntu 4096 Mar  2 15:02 deploy lrwxrwxrwx  1 ubuntu ubuntu   14 May 25 18:27 logs -> /var/log/arkin 

Disk layout

ubuntu@platform1:~$   df -h Filesystem                    Size  Used Avail Use% Mounted on /dev/mapper/vg-var            853G  3.7G  806G   1% /var /dev/mapper/vg-var+log         49G  1.1G   45G   3% /var/log /dev/mapper/vg-var+log+audit   20G   60M   19G   1% /var/log/audit /dev/mapper/vg-home            30G  6.5G   22G  24% /home 

But many times I am observing that symbolic link is changed to

drwxr-xr-x  6 ubuntu ubuntu 4096 May 31 08:41 logs 

Can someone let me know if there is a way to enable audit logs on the folder /home/ubuntu/logs so that I can get some idea which operation is breaking the symbolic link and creating a new /home/ubuntu/logs or some other ways I can debug this problem?

  • Filesystem – ext4
  • OS – Ubuntu 16.04