Customized File Monitoring with Auditd

aureport is part of a larger toolset that comes with auditd. Using auditd to monitor some preset events is already quite useful, but where it comes into its own is when you customize it to monitor whatever you want.

To push your rules into auditd on the fly you use auditctl