Apple - How to figure out what is causing the ownership of /usr/local to change from my-username to root

I had this exact same issue, and it turns out Sophos auto-update was to blame. I figured this out by running: sudo fs_usage | grep "usr/local"

It took a while, but eventually I saw Sophos's helpfully named "Installation" daemon messing with /usr/local's permissions.

I'm still trying to figure out an appropriate work around for this behavior.

EDIT: I believe Sophos has fixed this issue, see the link in the comments of this answer. It seems to be fixed for me at least!

Turns out Filewave is the culprit. Filewave is a system management software used by our school to push software updates. Thanks for the input.

I have just a rough idea how get the permission thief. This is not a solution to your problem, but more some sort of workaround.

What about writing a watchdog in Automator or with Hazel (folder actions) for watching this particular folder but instead of adding a function like Scale images you just use a shellscript which executes several shell commands:

• If the folder is changed in any way, just snapshot the permissions and the currently accessing process id with fuser <foldername>.
• then you lookup in the process table the process id (ps auxwwwwww | grep <process id>) and finally
• write an email to yourself with these collected informations.

Unfortunately I am no Automator sadhu, but I found out by Google there are plenty of solutions for such a similar problem.