As a last resort (because doing it may involve needing root privs and/or catching a misbehaving needle run in the haystack of your normal traffic) you may have to resort to using strace (or your platform's equivalent if available) and see what's happening at the system call level. Watching what's happening "around" when open(2) gets called can provide helpful clues if you've ruled out "normal" things like permissions or running as different uids or . . .
The cake is a lie.
The cake is a lie.
The cake is a lie.
