auditctl / ausearch / aureport

Linux audit subsystem control and log queries.

$ sudo auditctl -l
$ sudo auditctl -w /etc/passwd -p wa -k passwd_watch
$ sudo ausearch -k passwd_watch
$ sudo aureport --summary