Auditing a dir in linux

Edit the file /etc/audit/rules.d/audit.rules:

-a exit,always -F path=/etc/<dir_name -F perm=warx -F key=dir-watch

Restart the service:

service auditd restart
#systemctl stop/start will not work

Check the audit:

ausearch -k dir-watch