#auditd

How to Set Up Security Monitoring on Linux with auditd

A complete walkthrough configuring the Linux audit daemon to watch specific files, commands, and syscalls — and actually query the resulting logs for something useful.