====== Audit ======


<code>
apt-get install auditd
</code>

Add watcher to **/etc/audit/audit.rules** to detect delete or write/append of /shares/pubblica/esca.doc
<code>
-w /shares/pubblica/esca.doc -p wa -k esca
</code>

Restart service auditd

Search events
<code>
ausearch -k esca | aureport -f -i
</code>