audit rule

A line for auditd: which file or system call to watch and with which key to record the event — auditctl -w /etc/hosts -p wa -k hosts. Permanent rules live in /etc/audit/rules.d; ausearch -k finds events.