Audit Linux Security: Working with the Audit Log Create audit rules to watch `/etc/passwd` for reads, `/etc/sudoers/` for