Check this.https://isc.sans.edu/diary/Auditd+is+your+friend