A pretty sensible overview of auditd for those who aren't Linux sysadmins: <a href="https://linux-audit.com/configuring-and-auditing-linux-systems-with-audit-daemon/" rel="nofollow">https://linux-audit.com/configuring-and-auditing-linux-syste...</a>