Watch a file for process changes.

bash.sh

# TODO: This does not work

# To add a watcher
sudo auditctl -w </absolute/path/to/file>

# To remove a watcher
sudo auditctl -W </absolute/path/to/file>

# To list auditd rules
sudo auditctl -l

# Check for changes at `/var/log/audit/audit.log`.

# Example
sudo auditctl -w /home/daniel/Desktop/weird.txt -p wa
sudo auditctl -l
# -w /home/daniel/Desktop/weird.txt -p wa
sudo auditctl -W /home/daniel/Desktop/weird.txt -p wa
sudo auditctl -l
# No rules