Who changed the file: auditd

ausearch builds one event from several lines. The main one is SYSCALL: it holds both the process and the user (all fields).

type=SYSCALL ... syscall=rename success=yes
comm="sed" exe="/usr/bin/sed" auid=unset uid=root key=hosts

comm and exe — the short name and full path of the program that reached the file (here sed);
uid — which user the process ran as (the effective user);
auid — who logged in and started the chain (the login uid). For a service started at boot auid=unset: the system started it, with no person logged in. For an action by a logged-in user (via console, ssh or cron) auid is their name.

ppid in the event is the parent process. By it you see who started the program: ps -o unit= -p <ppid> names the service. That is how you get from a write to a file to the service or task that does it.

Check yourself 1 question

In the audit event for the /etc/hosts edit there is auid=unset, uid=root, comm="sed". What does this say about who changed the file?

A logged-in person's action would have auid as their name, not unset. unset means a service, not a login, started it.
The event has comm, exe, uid and ppid — enough to name the program and trace ppid to the service.
auid=unset is not a name but the absence of a login uid: no logged-in person started the chain. There would be a name if someone logged in via console, ssh or cron.

auid=unset means a boot-time service started the chain, not a logged-in person; comm/uid name the sed program as root. ppid shows what started it.

Key points

ausearch builds an event from lines; the main one, SYSCALL, holds the process and the user.
comm/exe are the program, uid is the effective user, auid is who logged in (unset for a boot-time service).
ppid leads to the parent: ps -o unit= -p <ppid> names the service that reached the file.

Who changed the file: auditd

Signing in is needed to start the machine