[CentOS] resolv.conf rewritten every reboot. How to figure out who and why?

I haven't been following this thread very closely since my last post, but 
if you want to know who is doing what ... use auditctl. 
<http://kbase.redhat.com/faq/docs/DOC-10108>

Barry